This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

Probably another rootkit

85 min read

This thread's last reply is from February 3, 2012, 1:38 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

xyonist
January 25, 2012, 12:40 AM UTC
My computer isn't always slow, but can sometimes become very, very slow and occasionally grinds to almost a complete stop for minutes at a time. When is becomes slow, icons on my taskbar next to the Start menu that show how many windows I have open will disappear at random, even though the window is still open. If that happens and I minimize the window, I need to use the Task Manager to end my browsing session. Not terribly inconvenient, but far from standard operating procedure. Here are my logs:

DDS.txt:

.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_23
Run by [removed] at 15:21:22 on 2012-01-24
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.254.57 [GMT -5:00]
.
AV: avast! Antivirus *Enabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Trend Micro PC-cillin Internet Security *Disabled/Outdated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
============== Running Processes ===============
.
C:\WINDOWS\system32\LEXBCES.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\LEXPPS.EXE
C:\Program Files\Java\jre6\bin\jqs.exe
C:\Program Files\Common Files\Motive\McciCMService.exe
C:\WINDOWS\system32\SearchIndexer.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe
C:\WINDOWS\system32\hphmon05.exe
C:\Program Files\Verizon\McciTrayApp.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe
C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Documents and Settings\Pete\Desktop\dds.scr
C:\WINDOWS\System32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\svchost.exe -k HTTPFilter
.
============== Pseudo HJT Report ===============
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = 127.0.0.1
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
BHO: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: {9D425283-D487-4337-BAB6-AB8354A81457} - No File
TB: avast! WebRep: {8e5e2654-ad2d-48bf-ac2d-d17f00898d06} - c:\program files\avast software\avast\aswWebRepIE.dll
TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} -
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
mRun: [igfxtray] c:\windows\system32\igfxtray.exe
mRun: [igfxpers] c:\windows\system32\igfxpers.exe
mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
mRun: [HPHUPD05] c:\program files\hewlett-packard\{45b6180b-dcab-4093-8ee8-6164457517f0}\hphupd05.exe
mRun: [HP Component Manager] "c:\program files\hp\hpcoretech\hpcmpmgr.exe"
mRun: [HP Software Update] "c:\program files\hewlett-packard\hp software update\HPWuSchd.exe"
mRun: [HPHmon05] c:\windows\system32\hphmon05.exe
mRun: [Verizon_McciTrayApp] "c:\program files\verizon\McciTrayApp.exe"
mRun: [SoundMAXPnP] c:\program files\analog devices\core\smax4pnp.exe
mRun: [Malwarebytes Anti-Malware (reboot)] "c:\program files\malwarebytes' anti-malware\mbam.exe" /runcleanupscript
mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
mRun: [APSDaemon] "c:\program files\common files\apple\apple application support\APSDaemon.exe"
mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
mRun: [avast] "c:\program files\avast software\avast\avastUI.exe" /nogui
dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
IE: &ieSpell Options - c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - res://c:\program files\iespell\iespell.dll/SPELLCHECK.HTM
IE: {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - res://c:\program files\iespell\iespell.dll/SPELLOPTION.HTM
IE: {CD67F990-D8E9-11d2-98FE-00C0F0318AFE}
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab
DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} - hxxp://www.worldwinner.com/games/v46/sc ... ecubes.cab
DPF: {04063354-A10E-4427-A1EC-F3CC81587BC6} - hxxp://www.worldwinner.com/games/v40/mines/mines.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shoc ... tor/sw.cab
DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/ ... ontrol.cab
DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} - hxxp://www.worldwinner.com/games/v47/sh ... Loader.cab
DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} - hxxp://www.worldwinner.com/games/v50/pool/pool.cab
DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} - hxxp://www.worldwinner.com/games/v44/wo ... rdcube.cab
DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab
DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} - hxxp://www.worldwinner.com/games/shared/wwlaunch.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} - hxxp://www.worldwinner.com/games/v48/luxor/luxor.cab
DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinsta ... s-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shoc ... wflash.cab
DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} - hxxp://mobileapps.blackberry.com/device ... Loader.cab
DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} - hxxp://www.worldwinner.com/games/v42/go ... olfsol.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} - hxxp://www.worldwinner.com/games/v52/ww ... spades.cab
TCP: DhcpNameServer = 192.168.1.1
TCP: Interfaces\{1A16A86E-C689-4BE8-B317-AD09B83852AB} : DhcpNameServer = 192.168.1.1
Handler: cetihpz - {CF184AD3-CDCB-4168-A3F7-8E447D129300} - c:\program files\hp\hpcoretech\comp\hpuiprot.dll
Notify: igfxcui - igfxdev.dll
Notify: WRNotifier - WRLogonNTF.dll
SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
.
================= FIREFOX ===================
.
FF - ProfilePath - c:\documents and settings\pete\application data\mozilla\firefox\profiles\b67i1qst.pete\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
FF - plugin: c:\program files\common files\motive\npMotive.dll
FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} - c:\program files\mozilla firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
FF - Ext: Smart Bookmarks Bar: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - %profile%\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: [removed] - c:\program files\avast software\avast\webrep\FF
.
============= SERVICES / DRIVERS ===============
.
R? aswSnx;aswSnx
S? aswFsBlk;aswFsBlk
S? aswSP;aswSP
S? avast! Antivirus;avast! Antivirus
S? IHA_MessageCenter;IHA_MessageCenter
.
=============== Created Last 30 ================
.
2012-01-24 17:17:00 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-24 17:15:29 41184 ----a-w- c:\windows\avastSS.scr
2012-01-24 17:14:49 -------- d-----w- c:\program files\AVAST Software
2012-01-24 17:14:49 -------- d-----w- c:\documents and settings\all users\application data\AVAST Software
2012-01-11 02:04:07 -------- d-----w- c:\program files\Defraggler
2012-01-11 01:40:38 -------- d-----w- c:\program files\CCleaner
2012-01-11 01:16:46 -------- d-----w- c:\documents and settings\pete\application data\WinPatrol
2012-01-11 01:15:52 -------- d-----w- c:\program files\BillP Studios
2012-01-11 01:15:51 -------- d-----w- c:\documents and settings\all users\application data\InstallMate
2011-12-31 04:08:02 -------- d-----w- C:\Sierra
.
==================== Find3M ====================
.
2011-12-29 14:23:18 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-26 01:23:48 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-26 01:23:48 256 ----a-w- c:\windows\system32\MSIevent.bat
2011-11-25 21:57:19 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25:32 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35:08 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-04 19:20:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23:59 385024 ----a-w- c:\windows\system32\html.iec
2011-11-03 15:28:36 386048 ----a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28:36 1292288 ----a-w- c:\windows\system32\quartz.dll
2011-11-01 16:07:10 1288704 ----a-w- c:\windows\system32\ole32.dll
2011-10-28 05:31:48 33280 ----a-w- c:\windows\system32\csrsrv.dll
.
============= FINISH: 15:37:51.32 ===============

Attach.txt:

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows XP Home Edition
Boot Device: \Device\HarddiskVolume2
Install Date: 12/27/2005 12:45:35 PM
System Uptime: 1/11/2012 3:47:54 AM (324 hours ago)
.
Motherboard: Dell Computer Corp. | | 0CF458
Processor: Intel(R) Celeron(R) CPU 2.53GHz | Microprocessor | 2527/533mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 34 GiB total, 5.636 GiB free.
D: is CDROM ()
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {36FC9E60-C465-11CF-8056-444553540000}
Description: USB Mass Storage Device
Device ID: USB\VID_03F0&PID_B202&MI_02\6&33074C2&0&0002
Manufacturer: Compatible USB storage device
Name: USB Mass Storage Device
PNP Device ID: USB\VID_03F0&PID_B202&MI_02\6&33074C2&0&0002
Service: USBSTOR
.
Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
Description: Parallel Device
Device ID: ROOT\LEGACY_HPFECP16\0000
Manufacturer:
Name: Parallel Device
PNP Device ID: ROOT\LEGACY_HPFECP16\0000
Service: HPFECP16
.
==== System Restore Points ===================
.
RP817: 1/18/2012 9:52:26 AM - System Checkpoint
RP818: 1/19/2012 10:25:56 AM - System Checkpoint
RP819: 1/20/2012 10:52:35 AM - System Checkpoint
RP820: 1/21/2012 11:52:39 AM - System Checkpoint
RP821: 1/22/2012 12:52:35 PM - System Checkpoint
RP822: 1/23/2012 1:53:44 PM - System Checkpoint
RP823: 1/24/2012 12:14:48 PM - avast! Free Antivirus Setup
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader 9.4.6
Adobe Shockwave Player
Amazon MP3 Downloader 1.0.12
AOLIcon
Apple Application Support
Apple Software Update
avast! Free Antivirus
Banctec Service Agreement
Baseball Mogul 2005
Black and White
CCleaner
Civilization III
Conexant D850 56K V.9x DFVc Modem
Critical Update for Windows Media Player 11 (KB959772)
Defraggler
Dell Digital Jukebox Driver
Dell Driver Reset Tool
Dell Media Experience
Dell Photo Printer 720
Dell System Restore
DellSupport
Digital Content Portal
Digital Line Detect
DigitImg
EducateU
FATE
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
Hotfix for Windows Media Format 11 SDK (KB929399)
Hotfix for Windows Media Player 11 (KB939683)
Hotfix for Windows XP (KB2158563)
Hotfix for Windows XP (KB2443685)
Hotfix for Windows XP (KB2570791)
Hotfix for Windows XP (KB2633952)
Hotfix for Windows XP (KB915800-v4)
Hotfix for Windows XP (KB952287)
Hotfix for Windows XP (KB954550-v5)
Hotfix for Windows XP (KB961118)
Hotfix for Windows XP (KB970653-v3)
Hotfix for Windows XP (KB976098-v2)
Hotfix for Windows XP (KB979306)
Hotfix for Windows XP (KB981793)
Hoyle Casino 2004
Hoyle Poker
HP Software Update
ieSpell 2.2.0 (build 647)
IHA_MessageCenter
Intel(R) Extreme Graphics 2 Driver
Intel(R) PRO Network Adapters and Drivers
Intel(R) PROSet for Wired Connections
Internet Explorer Default Page
IrfanView (remove only)
Java Auto Updater
Java(TM) 6 Update 23
Magic Pack v1.0 for Pocket Tanks Deluxe
Malwarebytes' Anti-Malware version 1.51.2.1300
Microsoft .NET Framework 1.1
Microsoft .NET Framework 1.1 Security Update (KB2656353)
Microsoft .NET Framework 1.1 Security Update (KB979906)
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Base Smart Card Cryptographic Service Provider Package
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Plus! Digital Media Edition Installer
Microsoft Plus! Photo Story 2 LE
Microsoft User-Mode Driver Framework Feature Pack 1.0
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Modem Helper
Monopoly Tycoon
Mozilla Firefox (3.6.25)
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MSXML 4.0 SP3 Parser (KB973685)
MSXML 6 Service Pack 2 (KB954459)
NetWaiting
Nuke Pack v1.1 for Pocket Tanks Deluxe
Party Pack for Pocket Tanks Deluxe
Photosmart 140,240,7200,7600,7700,7900 Series
Pocket Tanks Deluxe v1.3
PS7600
PSShortcuts
PSUsage
QuickTime
Redist
Rocket Pack v1.0 for Pocket Tanks Deluxe
Security Update for Microsoft .NET Framework 3.5 SP1 (KB2657424)
Security Update for Microsoft Windows (KB2564958)
Security Update for Step By Step Interactive Training (KB898458)
Security Update for Step By Step Interactive Training (KB923723)
Security Update for Windows Internet Explorer 8 (KB2183461)
Security Update for Windows Internet Explorer 8 (KB2360131)
Security Update for Windows Internet Explorer 8 (KB2416400)
Security Update for Windows Internet Explorer 8 (KB2482017)
Security Update for Windows Internet Explorer 8 (KB2497640)
Security Update for Windows Internet Explorer 8 (KB2510531)
Security Update for Windows Internet Explorer 8 (KB2530548)
Security Update for Windows Internet Explorer 8 (KB2544521)
Security Update for Windows Internet Explorer 8 (KB2559049)
Security Update for Windows Internet Explorer 8 (KB2586448)
Security Update for Windows Internet Explorer 8 (KB2618444)
Security Update for Windows Internet Explorer 8 (KB971961)
Security Update for Windows Internet Explorer 8 (KB974455)
Security Update for Windows Internet Explorer 8 (KB976325)
Security Update for Windows Internet Explorer 8 (KB978207)
Security Update for Windows Internet Explorer 8 (KB981332)
Security Update for Windows Internet Explorer 8 (KB982381)
Security Update for Windows Media Player (KB2378111)
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player (KB954155)
Security Update for Windows Media Player (KB968816)
Security Update for Windows Media Player (KB973540)
Security Update for Windows Media Player (KB975558)
Security Update for Windows Media Player (KB978695)
Security Update for Windows Media Player 10 (KB911565)
Security Update for Windows Media Player 10 (KB917734)
Security Update for Windows Media Player 11 (KB936782)
Security Update for Windows Media Player 11 (KB954154)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Search 4 - KB963093
Security Update for Windows XP (KB2079403)
Security Update for Windows XP (KB2115168)
Security Update for Windows XP (KB2121546)
Security Update for Windows XP (KB2160329)
Security Update for Windows XP (KB2229593)
Security Update for Windows XP (KB2259922)
Security Update for Windows XP (KB2279986)
Security Update for Windows XP (KB2286198)
Security Update for Windows XP (KB2296011)
Security Update for Windows XP (KB2296199)
Security Update for Windows XP (KB2347290)
Security Update for Windows XP (KB2360937)
Security Update for Windows XP (KB2387149)
Security Update for Windows XP (KB2393802)
Security Update for Windows XP (KB2412687)
Security Update for Windows XP (KB2419632)
Security Update for Windows XP (KB2423089)
Security Update for Windows XP (KB2436673)
Security Update for Windows XP (KB2440591)
Security Update for Windows XP (KB2443105)
Security Update for Windows XP (KB2476490)
Security Update for Windows XP (KB2476687)
Security Update for Windows XP (KB2478960)
Security Update for Windows XP (KB2478971)
Security Update for Windows XP (KB2479628)
Security Update for Windows XP (KB2479943)
Security Update for Windows XP (KB2481109)
Security Update for Windows XP (KB2483185)
Security Update for Windows XP (KB2485376)
Security Update for Windows XP (KB2485663)
Security Update for Windows XP (KB2491683)
Security Update for Windows XP (KB2503658)
Security Update for Windows XP (KB2503665)
Security Update for Windows XP (KB2506212)
Security Update for Windows XP (KB2506223)
Security Update for Windows XP (KB2507618)
Security Update for Windows XP (KB2507938)
Security Update for Windows XP (KB2508272)
Security Update for Windows XP (KB2508429)
Security Update for Windows XP (KB2509553)
Security Update for Windows XP (KB2511455)
Security Update for Windows XP (KB2524375)
Security Update for Windows XP (KB2535512)
Security Update for Windows XP (KB2536276-v2)
Security Update for Windows XP (KB2536276)
Security Update for Windows XP (KB2544893-v2)
Security Update for Windows XP (KB2544893)
Security Update for Windows XP (KB2555917)
Security Update for Windows XP (KB2562937)
Security Update for Windows XP (KB2566454)
Security Update for Windows XP (KB2567053)
Security Update for Windows XP (KB2567680)
Security Update for Windows XP (KB2570222)
Security Update for Windows XP (KB2570947)
Security Update for Windows XP (KB2584146)
Security Update for Windows XP (KB2592799)
Security Update for Windows XP (KB2598479)
Security Update for Windows XP (KB2603381)
Security Update for Windows XP (KB2618451)
Security Update for Windows XP (KB2619339)
Security Update for Windows XP (KB2620712)
Security Update for Windows XP (KB2624667)
Security Update for Windows XP (KB2631813)
Security Update for Windows XP (KB2633171)
Security Update for Windows XP (KB2639417)
Security Update for Windows XP (KB2646524)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB923689)
Security Update for Windows XP (KB938464)
Security Update for Windows XP (KB941569)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950760)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB951376)
Security Update for Windows XP (KB951698)
Security Update for Windows XP (KB951748)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954211)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956744)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB956803)
Security Update for Windows XP (KB956841)
Security Update for Windows XP (KB956844)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB958690)
Security Update for Windows XP (KB958869)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960715)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB960859)
Security Update for Windows XP (KB961371-v2)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961373)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB969059)
Security Update for Windows XP (KB969898)
Security Update for Windows XP (KB969947)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB970430)
Security Update for Windows XP (KB971468)
Security Update for Windows XP (KB971486)
Security Update for Windows XP (KB971557)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB971657)
Security Update for Windows XP (KB971961)
Security Update for Windows XP (KB972270)
Security Update for Windows XP (KB973346)
Security Update for Windows XP (KB973354)
Security Update for Windows XP (KB973507)
Security Update for Windows XP (KB973525)
Security Update for Windows XP (KB973869)
Security Update for Windows XP (KB973904)
Security Update for Windows XP (KB974112)
Security Update for Windows XP (KB974318)
Security Update for Windows XP (KB974392)
Security Update for Windows XP (KB974571)
Security Update for Windows XP (KB975025)
Security Update for Windows XP (KB975467)
Security Update for Windows XP (KB975560)
Security Update for Windows XP (KB975561)
Security Update for Windows XP (KB975562)
Security Update for Windows XP (KB975713)
Security Update for Windows XP (KB977165)
Security Update for Windows XP (KB977816)
Security Update for Windows XP (KB977914)
Security Update for Windows XP (KB978037)
Security Update for Windows XP (KB978251)
Security Update for Windows XP (KB978262)
Security Update for Windows XP (KB978338)
Security Update for Windows XP (KB978542)
Security Update for Windows XP (KB978601)
Security Update for Windows XP (KB978706)
Security Update for Windows XP (KB979309)
Security Update for Windows XP (KB979482)
Security Update for Windows XP (KB979559)
Security Update for Windows XP (KB979683)
Security Update for Windows XP (KB979687)
Security Update for Windows XP (KB980195)
Security Update for Windows XP (KB980218)
Security Update for Windows XP (KB980232)
Security Update for Windows XP (KB980436)
Security Update for Windows XP (KB981322)
Security Update for Windows XP (KB981852)
Security Update for Windows XP (KB981957)
Security Update for Windows XP (KB981997)
Security Update for Windows XP (KB982132)
Security Update for Windows XP (KB982214)
Security Update for Windows XP (KB982665)
Security Update for Windows XP (KB982802)
Snowball Pack v1.1 for Pocket Tanks Deluxe
Spotify
Stella 2.2
Stronghold Crusader
Taito Legends
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
Update for Windows Internet Explorer 8 (KB973874)
Update for Windows Internet Explorer 8 (KB976662)
Update for Windows Internet Explorer 8 (KB976749)
Update for Windows Internet Explorer 8 (KB980182)
Update for Windows XP (KB2141007)
Update for Windows XP (KB2345886)
Update for Windows XP (KB2467659)
Update for Windows XP (KB2541763)
Update for Windows XP (KB2607712)
Update for Windows XP (KB2616676)
Update for Windows XP (KB2641690)
Update for Windows XP (KB951978)
Update for Windows XP (KB955759)
Update for Windows XP (KB955839)
Update for Windows XP (KB961503)
Update for Windows XP (KB967715)
Update for Windows XP (KB968389)
Update for Windows XP (KB971029)
Update for Windows XP (KB971737)
Update for Windows XP (KB973687)
Update for Windows XP (KB973815)
Verizon Help and Support Tool
Verizon Media Manager
Verizon Online
Verizon WiFi Activation
Vz In Home Agent
WebCyberCoach 3.2 Dell
WebFldrs XP
Wi-Fi Connect
Windows Genuine Advantage Validation Tool (KB892130)
Windows Internet Explorer 7
Windows Internet Explorer 8
Windows Media Format 11 runtime
Windows Media Player 10
Windows Media Player 11
Windows Search 4.0
Windows XP Service Pack 3
WinPatrol
.
==== End Of File ===========================
deltalima
January 26, 2012, 8:36 PM UTC
checking your log, back soon.
deltalima
January 26, 2012, 8:42 PM UTC
Hi xyonist,

Welcome to the forum.

Please be aware that removing Malware is a potentially hazardous undertaking. I will take care not to knowingly suggest courses of action that might damage your computer. However it is impossible for me to foresee all interactions that may happen between the software on your computer and those we'll use to clear you of infection, and I cannot guarantee the safety of your system. It is possible that we might encounter situations where the only recourse is to re-format and re-install your operating system, or to necessitate you taking your computer to a repair shop.

Please note the following:
  • I will be working on your Malware issues, this may or may not, solve other issues you have with your machine.
  • The fixes are specific to your problem and should only be used for this issue on this machine.
  • Please do not run any scans or make any changes to the system unless I ask you too.
  • Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear.
  • If after 3 days you have not responded to this topic, it will be closed, and you will need to start a new one.
  • It's often worth reading through these instructions and printing them for ease of reference.
  • If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry.
  • Please reply to this thread. Do not start a new topic.


Could you tell me if Trend Micro PC-cillin Internet Security has previously been installed on this computer and if it has been removed?

Download and run OTL
Download OTL by Old Timer and save it to your Desktop.
  • Double click on OTL.exe to run it.
  • Under Output, ensure that Minimal Output is selected.
  • Under Extra Registry section, select Use SafeList.
  • Click the Scan All Users checkbox.
  • Click on Run Scan at the top left hand corner.
  • When done, two Notepad files will open.
    • OTL.txt <-- Will be opened
    • Extras.txt <-- Will be minimized
  • Please post the contents of these 2 Notepad files in your next reply.


Please download GMER Rootkit Scanner from here.
  • Double click the .exe file. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning at program start about rootkit activity and asks if you want to run a scan...click NO.
  • Run Gmer again and click on the Rootkit tab.
  • Look at the right hand side (under Files) and uncheck all drives with the exception of your C drive.
  • Make sure all other boxes on the right of the screen are checked, EXCEPT for "Show All".
  • Click on the "Scan" and wait for the scan to finish.
    Note: Before scanning, make sure all other running programs are closed and no other actions like a scheduled antivirus scan will occur while this scan completes. Also do not use your computer during the scan.
  • When completed, click on the Copy button and right-click on your Desktop, choose "New" > Text document. Once the file is created, open it and right-click again and choose Paste or Ctrl+V. Save the file as gmer.txt and copy the information in your next reply.
  • Note: If you have any problems, try running GMER in SAFE MODE

Important! Please do not select the "Show all" checkbox during the scan..

Please post the GMER log along with OTL.txt and Extras.txt from the OTL scan into your next reply.
xyonist
January 28, 2012, 2:37 PM UTC
Hi Deltalima. Thank you for looking into my problem. I apologize for the delay, but so far I have not been able to run GMER successfully in 5 attempts. When I try to run GMER in normal mode (three attempts), the program will run fine almost until completion, but then my entire system will freeze. I'm not able to use my mouse or keyboard and the "OK" button on GMER appears to flash, as if someone is trying to click it repeatedly. I've also tried to run GMER in safe mode, but both attempts resulted in my computer crashing within seconds of starting the program and the resulting BSOD informing me that there is something wrong with my system, although the message was different on both occasions.

To answer your question about Trend Micro PC-cillin Internet Security, this program was pre-installed on my PC when I purchased it new. I do believe I disabled it when I purchased BitDefender 2010 a few years ago since it's not a good idea to run two anti-virus programs simultaneously.

I was able to run the OTL program successfully, so I will post those logs for you now and continue to try to run GMER successfully until I hear back from you.

OTL:

OTL logfile created on: 1/27/2012 6:23:38 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Pete\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

253.98 Mb Total Physical Memory | 88.47 Mb Available Physical Memory | 34.83% Memory free
625.07 Mb Paging File | 306.89 Mb Available in Paging File | 49.10% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.20 Gb Total Space | 5.30 Gb Free Space | 15.51% Space Free | Partition Type: NTFS

Computer Name: D6KK1Z81 | User Name: Pete | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - C:\Documents and Settings\Pete\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe (Verizon)
PRC - C:\Program Files\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)
PRC - C:\WINDOWS\explorer.exe (Microsoft Corporation)
PRC - C:\WINDOWS\system32\hphmon05.exe (Hewlett-Packard)
PRC - C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
PRC - C:\Program Files\Hewlett-Packard\HP Software Update\hpwuSchd.exe (Hewlett-Packard)
PRC - C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Modules (No Company Name) ==========

MOD - C:\Program Files\AVAST Software\Avast\defs\12012701\algo.dll ()
MOD - C:\WINDOWS\assembly\GAC_32\CustomMarshalers\2.0.0.0__b03f5f7f11d50a3a\CustomMarshalers.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.ServiceProce#\abef85f2fb8ba830eda73e2d12e8d41e\System.ServiceProcess.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Management\90b90e700e59d73d6d692cf74e1ba16e\System.Management.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\CustomMarshalers\3e6deccf191ab943d3a0812a38ab5c97\CustomMarshalers.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Configuration\bce0720436dc6cb76006377f295ea365\System.Configuration.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System.Xml\70cacc44f0b4257f6037eda7a59a0aeb\System.Xml.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\System\af39f6e644af02873b9bae319f2bfb13\System.ni.dll ()
MOD - C:\WINDOWS\assembly\NativeImages_v2.0.50727_32\mscorlib\ca87ba84221991839abbe7d4bc9c6721\mscorlib.ni.dll ()
MOD - C:\WINDOWS\system32\spool\prtprocs\w32x86\DLBCPP5C.DLL ()


========== Win32 Services (SafeList) ==========

SRV - (HidServ) -- File not found
SRV - (AppMgmt) -- File not found
SRV - (IHA_MessageCenter) -- C:\Program Files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe (Verizon)
SRV - (avast! Antivirus) -- C:\Program Files\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (Pml Driver HPZ12) -- C:\WINDOWS\system32\HPZipm12.exe (HP)


========== Driver Services (SafeList) ==========

DRV - (aswSnx) -- C:\WINDOWS\System32\drivers\aswSnx.sys (AVAST Software)
DRV - (aswSP) -- C:\WINDOWS\System32\drivers\aswSP.sys (AVAST Software)
DRV - (aswRdr) -- C:\WINDOWS\System32\drivers\aswRdr.sys (AVAST Software)
DRV - (aswTdi) -- C:\WINDOWS\System32\drivers\aswTdi.sys (AVAST Software)
DRV - (aswMon2) -- C:\WINDOWS\System32\drivers\aswmon2.sys (AVAST Software)
DRV - (aswFsBlk) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys (AVAST Software)
DRV - (Aavmker4) -- C:\WINDOWS\System32\drivers\aavmker4.sys (AVAST Software)
DRV - (MREMP50) -- C:\Program Files\Common Files\Motive\MREMP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRESP50) -- C:\Program Files\Common Files\Motive\MRESP50.sys (Printing Communications Assoc., Inc. (PCAUSA))
DRV - (MRENDIS5) -- C:\Program Files\Common Files\Motive\MRENDIS5.sys (Motive, Inc.)
DRV - (MREMPR5) -- C:\Program Files\Common Files\Motive\MREMPR5.sys (Motive, Inc.)
DRV - (dsunidrv) -- C:\WINDOWS\system32\drivers\dsunidrv.sys (Gteko Ltd.)
DRV - (DSproct) -- C:\Program Files\DellSupport\GTAction\triggers\DSproct.sys (Gteko Ltd.)
DRV - (senfilt) -- C:\WINDOWS\system32\drivers\senfilt.sys (Creative Technology Ltd.)
DRV - (HSFHWBS2) -- C:\WINDOWS\system32\drivers\HSFHWBS2.sys (Conexant Systems, Inc.)
DRV - (winachsf) -- C:\WINDOWS\system32\drivers\HSF_CNXT.sys (Conexant Systems, Inc.)
DRV - (HSF_DP) -- C:\WINDOWS\system32\drivers\HSF_DP.sys (Conexant Systems, Inc.)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = http://news.yahoo.com [binary data]


IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,First Home Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.dell4me.com/myway
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0


IE - HKU\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1
IE - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
IE - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Restore = http://www.sportsims.net/
IE - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 127.0.0.1

========== FireFox ==========

FF - prefs.js..browser.startup.homepage: "http://www.bing.com/?pc=Z013&form=ZGAPHP"
FF - prefs.js..browser.search.selectedEngine: "Bing"
FF - prefs.js..keyword.URL: "http://www.bing.com/search?pc=Z013&form=ZGAADF&q="

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Motive.com/NpMotive,version=1.0: C:\Program Files\Common Files\Motive\npMotive.dll (Alcatel-Lucent)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\BitDefender\BitDefender 2010\bdaphffext\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\[removed]: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012/01/24 12:15:38 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/01/25 19:55:14 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.25\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/01/19 20:37:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Components: C:\Program Files\Mozilla Sunbird\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Sunbird 1.0b1\extensions\\Plugins: C:\Program Files\Mozilla Sunbird\plugins

[2010/07/06 15:30:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Extensions
[2010/07/06 15:30:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Extensions\{718e30fb-e89b-41dd-9da7-e25a45638b28}
[2012/01/26 18:31:58 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\extensions
[2011/12/29 03:27:24 | 000,000,000 | ---D | M] (Flagfox) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
[2010/05/26 20:13:50 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011/12/29 03:27:27 | 000,000,000 | ---D | M] (NoScript) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
[2009/10/24 14:13:10 | 000,000,000 | ---D | M] (Smart Bookmarks Bar) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\extensions\[removed]
[2011/05/09 19:21:28 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\nayboc75.default\extensions
[2011/05/09 19:21:29 | 000,000,000 | ---D | M] (eMusic Toolbar) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\nayboc75.default\extensions\{9ee802e8-c931-47ab-b570-aa8f791598ca}
[2010/07/06 15:30:51 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Pete\Application Data\Mozilla\Sunbird\Profiles\ua9aoi5m.default\extensions
[2011/04/26 18:34:03 | 000,001,919 | ---- | M] () -- C:\Documents and Settings\Pete\Application Data\Mozilla\Firefox\Profiles\nayboc75.default\searchplugins\bing-zugo.xml
[2012/01/26 18:31:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2011/01/02 20:40:47 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2009/09/13 21:10:06 | 000,047,104 | ---- | M] (BitDefender S.R.L.) -- C:\Program Files\mozilla firefox\components\FFComm.dll
[2010/11/12 18:53:06 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll

O1 HOSTS File: ([2006/02/21 13:22:36 | 000,000,734 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
O3 - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
O4 - HKLM..\Run: [APSDaemon] C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [HP Software Update] C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe (HP)
O4 - HKLM..\Run: [HPHmon05] C:\WINDOWS\system32\hphmon05.exe (Hewlett-Packard)
O4 - HKLM..\Run: [HPHUPD05] C:\Program Files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe (Hewlett-Packard)
O4 - HKLM..\Run: [Malwarebytes Anti-Malware (reboot)] C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Verizon_McciTrayApp] C:\Program Files\Verizon\McciTrayApp.exe (Alcatel-Lucent)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Main present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: &ieSpell Options - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O8 - Extra context menu item: Check &Spelling - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra Button: ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell - {0E17D5B7-9F5D-4fee-9DF6-CA6EE38B68A8} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O9 - Extra 'Tools' menuitem : ieSpell Options - {1606D6F9-9D3B-4aea-A025-ED5B2FD488E7} - C:\Program Files\ieSpell\iespell.dll (Red Egg Software)
O16 - DPF: {02A2D714-433E-46E4-B217-7C3B3FAF8EAE} http://www.worldwinner.com/games/v46/scrabblecubes/scrabblecubes.cab (ScrabbleCubes Control)
O16 - DPF: {04063354-A10E-4427-A1EC-F3CC81587BC6} http://www.worldwinner.com/games/v40/mines/mines.cab (Mines Control)
O16 - DPF: {166B1BCA-3F9C-11CF-8075-444553540000} http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab (Shockwave ActiveX Control)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} http://download.microsoft.com/download/8/3/d/83d1fe15-fe0f-4bdf-b09c-4e3c49808ec7/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {1A1F56AA-3401-46F9-B277-D57F3421F821} http://www.worldwinner.com/games/v47/shared/FunGamesLoader.cab (FunGamesLoader Object)
O16 - DPF: {33E54F7F-561C-49E6-929B-D7E76D3AFEB1} http://www.worldwinner.com/games/v50/pool/pool.cab (Pool Control)
O16 - DPF: {6F6DBC29-7A0C-4AC0-A42D-10EC70678526} http://www.worldwinner.com/games/v44/wordcube/wordcube.cab (Word Cubes Control)
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} http://download.eset.com/special/eos/OnlineScanner.cab (Reg Error: Key error.)
O16 - DPF: {8A94C905-FF9D-43B6-8708-F0F22D22B1CB} http://www.worldwinner.com/games/shared/wwlaunch.cab (Wwlaunch Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {A91FB93D-7561-4524-8484-5C27C8FA8D42} http://www.worldwinner.com/games/v48/luxor/luxor.cab (WwLuxor Control)
O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} http://download.macromedia.com/pub/shoc ... wflash.cab (Shockwave Flash Object)
O16 - DPF: {DAF7E6E6-D53A-439A-B28D-12271406B8A9} http://mobileapps.blackberry.com/devicesoftware/AxLoader.cab (RIM AxLoader)
O16 - DPF: {E12EB891-D000-421B-A8ED-EDE1BDCA14A0} http://www.worldwinner.com/games/v42/golfsol/golfsol.cab (GolfSol Control)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O16 - DPF: {E70E3E64-2793-4AEF-8CC8-F1606BE563B0} http://www.worldwinner.com/games/v52/wwspades/wwspades.cab (WWSpades Control)
O16 - DPF: Microsoft XML Parser for Java file://C:\WINDOWS\Java\classes\xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A16A86E-C689-4BE8-B317-AD09B83852AB}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\cetihpz {CF184AD3-CDCB-4168-A3F7-8E447D129300} - C:\Program Files\HP\hpcoretech\comp\hpuiprot.dll (Hewlett-Packard Company)
O20 - HKLM Winlogon: Shell - (Explorer.exe) -C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) -C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - Winlogon\Notify\WRNotifier: DllName - (WRLogonNTF.dll) - File not found
O24 - Desktop WallPaper: C:\Documents and Settings\Pete\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Documents and Settings\Pete\Local Settings\Application Data\Microsoft\Wallpaper1.bmp
O28 - HKLM ShellExecuteHooks: {56F9679E-7826-4C84-81F3-532071A8BCC5} - C:\Program Files\Windows Desktop Search\MsnlNamespaceMgr.dll (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2004/08/10 14:04:08 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O33 - MountPoints2\{614b7b18-626a-11dd-9054-001320ac9975}\Shell - "" = AutoRun
O33 - MountPoints2\{614b7b18-626a-11dd-9054-001320ac9975}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{614b7b18-626a-11dd-9054-001320ac9975}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (SsiEfr.e)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*

========== Files/Folders - Created Within 30 Days ==========

[2012/01/27 18:11:26 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
[2012/01/26 14:10:17 | 000,000,000 | ---D | C] -- C:\b5405763cbcb5da0e20097b71f12
[2012/01/26 13:52:57 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Local Settings\Application Data\Intuit
[2012/01/26 13:35:19 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Local Settings\Application Data\IsolatedStorage
[2012/01/26 13:34:42 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Intuit
[2012/01/26 13:33:50 | 000,000,000 | ---D | C] -- C:\Program Files\TurboTax
[2012/01/26 01:43:33 | 000,000,000 | ---D | C] -- C:\e919ddc6f515ef7dbeed
[2012/01/26 01:25:56 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\Intuit
[2012/01/24 12:17:12 | 000,020,568 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswFsBlk.sys
[2012/01/24 12:17:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\avast! Free Antivirus
[2012/01/24 12:17:11 | 000,314,456 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSP.sys
[2012/01/24 12:17:02 | 000,034,392 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswRdr.sys
[2012/01/24 12:17:01 | 000,052,952 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswTdi.sys
[2012/01/24 12:17:00 | 000,435,032 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswSnx.sys
[2012/01/24 12:16:58 | 000,111,320 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon2.sys
[2012/01/24 12:16:58 | 000,105,176 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aswmon.sys
[2012/01/24 12:16:57 | 000,030,808 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\drivers\aavmker4.sys
[2012/01/24 12:15:29 | 000,041,184 | ---- | C] (AVAST Software) -- C:\WINDOWS\avastSS.scr
[2012/01/24 12:15:28 | 000,199,816 | ---- | C] (AVAST Software) -- C:\WINDOWS\System32\aswBoot.exe
[2012/01/24 12:14:49 | 000,000,000 | ---D | C] -- C:\Program Files\AVAST Software
[2012/01/24 12:14:49 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\AVAST Software
[2012/01/10 21:04:12 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\Defraggler
[2012/01/10 21:04:07 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2012/01/10 20:47:46 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Pete\Recent
[2012/01/10 20:40:44 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\CCleaner
[2012/01/10 20:40:38 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012/01/10 20:16:46 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Pete\Application Data\WinPatrol
[2012/01/10 20:15:52 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Start Menu\Programs\WinPatrol
[2012/01/10 20:15:52 | 000,000,000 | ---D | C] -- C:\Program Files\BillP Studios
[2012/01/10 20:15:51 | 000,000,000 | ---D | C] -- C:\Documents and Settings\All Users\Application Data\InstallMate
[2012/01/10 17:14:17 | 000,607,260 | R--- | C] (Swearware) -- C:\Documents and Settings\Pete\Desktop\dds.scr
[2011/12/30 23:08:02 | 000,000,000 | ---D | C] -- C:\Sierra
[2003/12/09 12:16:52 | 000,442,368 | ---- | C] ( ) -- C:\WINDOWS\System32\comintfs.dll
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2012/01/27 18:30:01 | 000,000,420 | -H-- | M] () -- C:\WINDOWS\tasks\User_Feed_Synchronization-{E0E55684-B27B-4240-9149-5E6FED5E3F11}.job
[2012/01/27 18:20:03 | 000,302,592 | ---- | M] () -- C:\Documents and Settings\Pete\Desktop\b5veueq0.exe
[2012/01/27 18:10:46 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Pete\Desktop\OTL.exe
[2012/01/27 18:05:24 | 000,000,340 | ---- | M] () -- C:\WINDOWS\tasks\HP Usg Daily.job
[2012/01/26 14:32:45 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2012/01/26 14:32:41 | 266,391,552 | -HS- | M] () -- C:\hiberfil.sys
[2012/01/26 01:49:37 | 000,499,344 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2012/01/26 01:49:37 | 000,086,558 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2012/01/24 12:17:13 | 000,001,689 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/01/24 12:16:59 | 000,002,625 | ---- | M] () -- C:\WINDOWS\System32\CONFIG.NT
[2012/01/11 03:48:12 | 000,098,256 | ---- | M] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2012/01/11 03:31:18 | 000,001,374 | ---- | M] () -- C:\WINDOWS\imsins.BAK
[2012/01/10 21:04:12 | 000,001,580 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2012/01/10 20:54:06 | 000,759,020 | ---- | M] () -- C:\Documents and Settings\Pete\My Documents\cc_20120110_205345.reg
[2012/01/10 20:40:44 | 000,000,682 | ---- | M] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2012/01/10 17:14:15 | 000,607,260 | R--- | M] (Swearware) -- C:\Documents and Settings\Pete\Desktop\dds.scr
[2012/01/04 18:06:08 | 000,000,318 | ---- | M] () -- C:\WINDOWS\tasks\HP DArC Task #Hewlett-Packard#7600#MY3B6320MYK3.job
[2011/12/29 09:23:18 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[1 C:\WINDOWS\*.tmp files -> C:\WINDOWS\*.tmp -> ]

========== Files Created - No Company Name ==========

[2012/01/27 18:20:05 | 000,302,592 | ---- | C] () -- C:\Documents and Settings\Pete\Desktop\b5veueq0.exe
[2012/01/24 12:17:13 | 000,001,689 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\avast! Free Antivirus.lnk
[2012/01/11 03:02:45 | 000,001,374 | ---- | C] () -- C:\WINDOWS\imsins.BAK
[2012/01/10 21:04:11 | 000,001,580 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\Defraggler.lnk
[2012/01/10 20:53:51 | 000,759,020 | ---- | C] () -- C:\Documents and Settings\Pete\My Documents\cc_20120110_205345.reg
[2012/01/10 20:40:44 | 000,000,682 | ---- | C] () -- C:\Documents and Settings\All Users\Desktop\CCleaner.lnk
[2011/01/06 21:47:33 | 000,006,371 | R--- | C] () -- C:\WINDOWS\System32\hphmon05.dat
[2011/01/06 21:47:11 | 000,018,283 | ---- | C] () -- C:\WINDOWS\HPHins01.dat
[2011/01/06 21:47:11 | 000,004,284 | ---- | C] () -- C:\WINDOWS\hphmdl01.dat
[2010/03/25 18:30:43 | 000,077,312 | ---- | C] () -- C:\WINDOWS\mbr.exe
[2010/01/21 21:42:08 | 000,014,012 | -H-- | C] () -- C:\WINDOWS\System32\mlfcache.dat
[2009/12/08 20:06:46 | 000,000,041 | ---- | C] () -- C:\WINDOWS\SIERRA.INI
[2009/10/15 18:53:06 | 000,000,132 | ---- | C] () -- C:\WINDOWS\System32\rezumatenoi.dat
[2009/10/15 18:29:32 | 000,000,016 | ---- | C] () -- C:\WINDOWS\System32\asdict.dat
[2009/10/15 18:29:32 | 000,000,004 | ---- | C] () -- C:\WINDOWS\System32\aspdict-en.dat
[2009/03/05 18:35:12 | 000,045,568 | ---- | C] () -- C:\WINDOWS\UniFish3.exe
[2008/05/26 20:59:42 | 000,018,904 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschematrivial.bin
[2008/05/26 20:59:40 | 000,106,605 | ---- | C] () -- C:\WINDOWS\System32\structuredqueryschema.bin
[2007/09/27 09:51:02 | 000,020,698 | ---- | C] () -- C:\WINDOWS\System32\idxcntrs.ini
[2007/09/27 09:48:48 | 000,030,628 | ---- | C] () -- C:\WINDOWS\System32\gsrvctr.ini
[2007/09/27 09:48:28 | 000,031,698 | ---- | C] () -- C:\WINDOWS\System32\gthrctr.ini
[2007/08/02 20:30:08 | 000,000,441 | ---- | C] () -- C:\WINDOWS\PowerReg.dat
[2007/02/19 15:26:08 | 000,000,058 | ---- | C] () -- C:\WINDOWS\ScrAntic.ini
[2007/02/07 12:52:33 | 000,060,928 | ---- | C] () -- C:\Documents and Settings\Pete\Local Settings\Application Data\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2006/09/08 15:47:43 | 000,000,002 | ---- | C] () -- C:\WINDOWS\msoffice.ini
[2006/06/13 19:49:43 | 000,001,176 | ---- | C] () -- C:\WINDOWS\checkip.dat
[2006/02/07 11:17:33 | 000,684,032 | ---- | C] () -- C:\WINDOWS\libeay32.dll
[2006/02/07 11:17:33 | 000,155,648 | ---- | C] () -- C:\WINDOWS\ssleay32.dll
[2006/01/31 04:34:44 | 000,081,244 | ---- | C] () -- C:\WINDOWS\xobglu32.dll
[2006/01/31 04:34:44 | 000,063,488 | ---- | C] () -- C:\WINDOWS\xobglu16.dll
[2006/01/24 17:35:02 | 000,000,246 | ---- | C] () -- C:\WINDOWS\dellstat.ini
[2006/01/19 12:51:58 | 000,006,550 | ---- | C] () -- C:\WINDOWS\jautoexp.dat
[2006/01/19 00:50:50 | 000,000,670 | ---- | C] () -- C:\WINDOWS\SportballChallenge.ini
[2006/01/19 00:26:31 | 000,000,014 | ---- | C] () -- C:\WINDOWS\popcinfo.dat
[2005/12/27 12:58:29 | 000,004,184 | -HS- | C] () -- C:\WINDOWS\System32\KGyGaAvL.sys
[2005/12/27 12:58:29 | 000,000,104 | RHS- | C] () -- C:\WINDOWS\System32\6287751CD3.sys
[2005/12/27 12:51:22 | 000,000,127 | ---- | C] () -- C:\Documents and Settings\Pete\Local Settings\Application Data\fusioncache.dat
[2005/12/07 14:14:18 | 000,000,061 | ---- | C] () -- C:\WINDOWS\smscfg.ini
[2005/12/07 14:07:40 | 000,149,504 | ---- | C] () -- C:\WINDOWS\UNWISE.EXE
[2005/12/07 13:59:18 | 000,000,335 | ---- | C] () -- C:\WINDOWS\nsreg.dat
[2005/12/07 13:36:52 | 000,049,152 | ---- | C] () -- C:\WINDOWS\setpwrcg.exe
[2005/12/07 13:36:28 | 000,012,288 | ---- | C] () -- C:\WINDOWS\System32\e100bmsg.dll
[2005/12/07 13:36:24 | 000,000,392 | ---- | C] () -- C:\WINDOWS\System32\OEMINFO.INI
[2005/01/28 09:08:34 | 000,000,000 | ---- | C] () -- C:\WINDOWS\System32\px.ini
[2004/08/10 14:12:05 | 000,000,882 | ---- | C] () -- C:\WINDOWS\orun32.ini
[2004/08/10 14:07:31 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2004/08/10 14:02:15 | 000,021,640 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat
[2004/08/10 14:01:18 | 000,001,793 | ---- | C] () -- C:\WINDOWS\System32\fxsperf.ini
[2004/08/10 13:57:52 | 000,004,161 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2004/08/10 13:57:15 | 000,098,256 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2004/08/10 13:51:21 | 000,004,569 | ---- | C] () -- C:\WINDOWS\System32\secupd.dat
[2004/08/10 13:51:20 | 000,499,344 | ---- | C] () -- C:\WINDOWS\System32\perfh009.dat
[2004/08/10 13:51:20 | 000,272,128 | ---- | C] () -- C:\WINDOWS\System32\perfi009.dat
[2004/08/10 13:51:20 | 000,086,558 | ---- | C] () -- C:\WINDOWS\System32\perfc009.dat
[2004/08/10 13:51:20 | 000,028,626 | ---- | C] () -- C:\WINDOWS\System32\perfd009.dat
[2004/08/10 13:51:18 | 000,004,627 | ---- | C] () -- C:\WINDOWS\System32\oembios.dat
[2004/08/10 13:51:17 | 013,107,200 | ---- | C] () -- C:\WINDOWS\System32\oembios.bin
[2004/08/10 13:51:16 | 000,000,741 | ---- | C] () -- C:\WINDOWS\System32\noise.dat
[2004/08/10 13:51:12 | 000,673,088 | ---- | C] () -- C:\WINDOWS\System32\mlang.dat
[2004/08/10 13:51:11 | 000,046,258 | ---- | C] () -- C:\WINDOWS\System32\mib.bin
[2004/08/10 13:51:05 | 000,218,003 | ---- | C] () -- C:\WINDOWS\System32\dssec.dat
[2004/08/10 13:50:56 | 000,001,804 | ---- | C] () -- C:\WINDOWS\System32\dcache.bin
[2004/02/10 14:08:00 | 000,000,373 | ---- | C] () -- C:\WINDOWS\System32\dlbccoin.ini
[2002/11/13 14:40:22 | 000,040,960 | ---- | C] () -- C:\WINDOWS\System32\dlbcvs.dll
[1998/07/22 02:50:28 | 000,035,328 | ---- | C] () -- C:\WINDOWS\hpfsched.exe

========== Alternate Data Streams ==========

@Alternate Data Stream - 125 bytes -> C:\Documents and Settings\All Users\Application Data\TEMP:5C321E34

< End of report >


Extras:

OTL Extras logfile created on: 1/27/2012 6:23:38 PM - Run 1
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Documents and Settings\Pete\Desktop
Windows XP Home Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000409 | Country: United States | Language: ENU | Date Format: M/d/yyyy

253.98 Mb Total Physical Memory | 88.47 Mb Available Physical Memory | 34.83% Memory free
625.07 Mb Paging File | 306.89 Mb Available in Paging File | 49.10% Paging File free
Paging file location(s): C:\pagefile.sys 384 768 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 34.20 Gb Total Space | 5.30 Gb Free Space | 15.51% Space Free | Partition Type: NTFS

Computer Name: D6KK1Z81 | User Name: Pete | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

[HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files\Mozilla Firefox\firefox.exe" -requestPending -osint -url "%1" (Mozilla Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
"DisableMonitoring" = 1

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows NT\SystemRestore]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]
"139:TCP" = 139:TCP:*:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:*:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:*:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:*:Enabled:@xpsp2res.dll,-22002
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
"DisableNotifications" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007
"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008
"139:TCP" = 139:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22004
"445:TCP" = 445:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22005
"137:UDP" = 137:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22001
"138:UDP" = 138:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22002
"67:UDP" = 67:UDP:*:Enabled:DHCP Discovery Service
"9051:UDP" = 9051:UDP:LocalSubNet:Enabled:FiOS Tech Wizard
"50000:UDP" = 50000:UDP:*:Enabled:IHA_MessageCenter

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe" = C:\Program Files\Common Files\AOL\ACS\AOLacsd.exe:*:Enabled:AOL
"C:\Program Files\Common Files\AOL\ACS\AOLDial.exe" = C:\Program Files\Common Files\AOL\ACS\AOLDial.exe:*:Enabled:AOL
"C:\Program Files\America Online 9.0\waol.exe" = C:\Program Files\America Online 9.0\waol.exe:*:Enabled:AOL

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\Real\RealPlayer\realplay.exe" = C:\Program Files\Real\RealPlayer\realplay.exe:*:Disabled:RealPlayer
"C:\Program Files\EA GAMES\American McGee's Alice\alice.exe" = C:\Program Files\EA GAMES\American McGee's Alice\alice.exe:*:Enabled:American McGee's Alice
"C:\Program Files\LimeWire\LimeWire.exe" = C:\Program Files\LimeWire\LimeWire.exe:*:Disabled:LimeWire
"C:\StubInstaller.exe" = C:\StubInstaller.exe:*:Disabled:LimeWire swarmed installer
"C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe" = C:\Program Files\Lionhead Studios Ltd\Black & White\runblack.exe:*:Enabled:lh
"C:\Program Files\Lionhead Studios Ltd\Black & White\CreatureIsle\CreatureIsle.exe" = C:\Program Files\Lionhead Studios Ltd\Black & White\CreatureIsle\CreatureIsle.exe:*:Enabled:lh
"C:\Program Files\Sierra\FEAR\fpupdate.exe" = C:\Program Files\Sierra\FEAR\fpupdate.exe:*:Disabled:fpupdate
"C:\Program Files\Sierra\FEAR\FEARServer.exe" = C:\Program Files\Sierra\FEAR\FEARServer.exe:*:Enabled:F.E.A.R. Stand-Alone Server
"C:\Program Files\Pando Networks\Pando\pando.exe" = C:\Program Files\Pando Networks\Pando\pando.exe:*:Disabled:pando
"C:\Program Files\Infogrames Interactive\Monopoly Tycoon\mc.exe" = C:\Program Files\Infogrames Interactive\Monopoly Tycoon\mc.exe:*:Enabled:Monopoly Tycoon -- (DeepRed Games Ltd)
"C:\Program Files\Skype\Phone\Skype.exe" = C:\Program Files\Skype\Phone\Skype.exe:*:Disabled:Skype
"C:\Program Files\Google\Google Earth\plugin\geplugin.exe" = C:\Program Files\Google\Google Earth\plugin\geplugin.exe:*:Disabled:Google Earth
"C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe" = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe:*:Enabled:EasyShare
"C:\Program Files\Google\Google Earth\client\googleearth.exe" = C:\Program Files\Google\Google Earth\client\googleearth.exe:*:Enabled:Google Earth
"C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Program Files\Common Files\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)
"C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe" = C:\Program Files\Verizon\Verizon Media Manager\Release\Verizon Media Manager.exe:*:Enabled:Verizon Media Manager -- ()
"C:\Program Files\Verizon\Verizon Media Manager\Release\VZVideoAgent.exe" = C:\Program Files\Verizon\Verizon Media Manager\Release\VZVideoAgent.exe:*:Enabled:VZVideoAgent -- (Verizon)
"C:\Documents and Settings\Pete\Application Data\Spotify\spotify.exe" = C:\Documents and Settings\Pete\Application Data\Spotify\spotify.exe:*:Enabled:Spotify -- (Spotify Ltd)


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{007811BF-E310-4285-BFC6-55DB29B3EDDE}" = WinPatrol
"{0EB5D9B7-8E6C-4A9E-B74F-16B7EE89A67B}" = Microsoft Plus! Photo Story 2 LE
"{0F052922-4BCE-4763-A540-00857554336D}" = Redist
"{149C2374-E707-4B53-A487-A2DA2064E03D}" = Vz In Home Agent
"{17334AAF-C9E7-483B-9F45-E3FCAF07FFA7}" = Intel(R) PROSet for Wired Connections
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2157961D-0507-44A8-BCF2-1EE2D439E8DF}" = Civilization III
"{224C47F4-CB95-406C-8AD6-81002FEED0CF}" = Hoyle Casino 2004
"{25EF00BE-F17B-11D6-88EA-000476CD2443}" = Verizon Online
"{26A24AE4-039D-4CA4-87B4-2F83216016FF}" = Java(TM) 6 Update 23
"{2DBFBD32-00BB-4678-B77B-8F5F729842BC}" = PS7600
"{33BB4982-DC52-4886-A03B-F4C5C80BEE89}" = Windows Media Player 10
"{350C97B0-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{35BDEFF1-A610-4956-A00D-15453C116395}" = Internet Explorer Default Page
"{3F92ABBB-6BBF-11D5-B229-002078017FBF}" = NetWaiting
"{44863FE1-AE61-4C81-9BF6-FBC467785D32}" = Taito Legends
"{4491C4CE-1B25-417C-B361-86F22FA9A722}" = Hoyle Poker
"{45B6180B-DCAB-4093-8EE8-6164457517F0}" = Photosmart 140,240,7200,7600,7700,7900 Series
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B9F45E8-E3CE-40B4-9463-80A9B3481DEF}" = Banctec Service Agreement
"{517B8FB2-26EE-43B0-AE1B-07408860AA69}" = DigitImg
"{53C49C8D-DFB2-42B9-A7EF-0F9CA386CC13}" = IHA_MessageCenter
"{5905F42D-3F5F-4916-ADA6-94A3646AEE76}" = Dell Driver Reset Tool
"{60758250-C8CF-47EB-8CB6-E0C3B84D8207}" = PSShortcuts
"{62BD0AE0-4EB1-4BBB-8F43-B6400C8FEB2C}" = AOLIcon
"{6D5FCA42-1486-4E32-AFE8-1B7E2AA59D33}" = Digital Content Portal
"{6E45BA47-383C-4C1E-8ED0-0D4845C293D7}" = Microsoft Plus! Digital Media Edition Installer
"{74F7662C-B1DB-489E-A8AC-07A06B24978B}" = Dell System Restore
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime
"{7EFA5E6F-74F7-4AFB-8AEA-AA790BD3A76D}" = DellSupport
"{7F142D56-3326-11D5-B229-002078017FBF}" = Modem Helper
"{8A708DD8-A5E6-11D4-A706-000629E95E20}" = Intel(R) Extreme Graphics 2 Driver
"{8C3727F2-8E37-49E4-820C-03B1677F53B6}" = Stronghold Crusader
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E44650F-7273-4FF7-B7D9-39868C7CA113}" = Baseball Mogul 2005
"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2
"{A683A2C0-821C-486F-858C-FA634DB5E864}" = EducateU
"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support
"{AC0EE5B0-A8FB-4D0A-AF03-2EDC518F841B}" = Dell Media Experience
"{AC76BA86-7AD7-1033-7B44-A94000000001}" = Adobe Reader 9.4.6
"{B975F4A1-63B6-11D4-BFEC-005004AF2D32}" = Monopoly Tycoon
"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2
"{C29CE41A-3268-4A5C-8B29-5799906785E9}" = Wi-Fi Connect
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D43BB532-3537-4CE9-9CBB-92533BD29F0C}" = HP Software Update
"{DE4997B5-55AD-4878-97A7-C9FA84FE23C7}" = PSUsage
"{E51B4CD9-A0A6-4324-B26A-31B3F2DE26CE}" = Black and White
"{E646DCF0-5A68-11D5-B229-002078017FBF}" = Digital Line Detect
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player
"Amazon MP3 Downloader" = Amazon MP3 Downloader 1.0.12
"avast" = avast! Free Antivirus
"CCleaner" = CCleaner
"CNXT_MODEM_PCI_VEN_14F1&DEV_2F20&SUBSYS_200F14F1" = Conexant D850 56K V.9x DFVc Modem
"Defraggler" = Defraggler
"Dell Digital Jukebox Driver" = Dell Digital Jukebox Driver
"Dell Photo Printer 720" = Dell Photo Printer 720
"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs
"ie7" = Windows Internet Explorer 7
"ie8" = Windows Internet Explorer 8
"ieSpell" = ieSpell 2.2.0 (build 647)
"InstallShield_{224C47F4-CB95-406C-8AD6-81002FEED0CF}" = Hoyle Casino 2004
"InstallShield_{4491C4CE-1B25-417C-B361-86F22FA9A722}" = Hoyle Poker
"IrfanView" = IrfanView (remove only)
"Magic Pack for Pocket Tanks Deluxe_is1" = Magic Pack v1.0 for Pocket Tanks Deluxe
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware version 1.51.2.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Mozilla Firefox (3.6.25)" = Mozilla Firefox (3.6.25)
"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP
"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs
"Nuke Pack for Pocket Tanks Deluxe_is1" = Nuke Pack v1.1 for Pocket Tanks Deluxe
"Party Pack for Pocket Tanks Deluxe_is1" = Party Pack for Pocket Tanks Deluxe
"Pocket Tanks Deluxe_is1" = Pocket Tanks Deluxe v1.3
"PROSet" = Intel(R) PRO Network Adapters and Drivers
"Rocket Pack for Pocket Tanks Deluxe_is1" = Rocket Pack v1.0 for Pocket Tanks Deluxe
"Snowball Pack for Pocket Tanks Deluxe_is1" = Snowball Pack v1.1 for Pocket Tanks Deluxe
"Stella_is1" = Stella 2.2
"TurboTax 2011" = TurboTax 2011
"Verizon Help and Support" = Verizon Help and Support Tool
"Verizon Media Manager" = Verizon Media Manager
"Verizon WiFi Activation_is1" = Verizon WiFi Activation
"WebCyberCoach_wtrb" = WebCyberCoach 3.2 Dell
"Windows Media Format Runtime" = Windows Media Format 11 runtime
"Windows Media Player" = Windows Media Player 11
"Windows XP Service Pack" = Windows XP Service Pack 3
"WMFDist11" = Windows Media Format 11 runtime
"wmp11" = Windows Media Player 11
"WT015792" = FATE
"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Spotify" = Spotify

========== Last 10 Event Log Errors ==========

[ Application Events ]
Error - 1/26/2012 2:58:13 AM | Computer Name = D6KK1Z81 | Source = Application Hang | ID = 1002
Description = Hanging application setup.exe, version 2011.1.0.93, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/26/2012 2:58:13 AM | Computer Name = D6KK1Z81 | Source = Application Hang | ID = 1002
Description = Hanging application setup.exe, version 2011.1.0.93, hang module hungapp,
version 0.0.0.0, hang address 0x00000000.

Error - 1/26/2012 2:36:15 PM | Computer Name = D6KK1Z81 | Source = MsiInstaller | ID = 11704
Description = Product: TurboTax 2011 wrapper -- Error 1704. An installation for
Microsoft .NET Framework 4 Client Profile is currently suspended. You must undo
the changes made by that installation to continue. Do you want to undo those changes?

Error - 1/26/2012 2:47:37 PM | Computer Name = D6KK1Z81 | Source = .NET Runtime Optimization Service | ID = 1111
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Service reached limit of transient errors. Will shut down. Last error returned
from Service Manager: 0x80029c4a.

Error - 1/26/2012 2:51:32 PM | Computer Name = D6KK1Z81 | Source = MsiInstaller | ID = 11304
Description = Product: TurboTax 2011 WinPerReleaseEngine -- Error 1304. Error writing
to file: Intuit.Spc.Esd.Client.BusinessLogic.dll. Verify that you have access
to that directory.

Error - 1/26/2012 2:51:33 PM | Computer Name = D6KK1Z81 | Source = MsiInstaller | ID = 10005
Description = Product: TurboTax 2011 WinPerReleaseEngine -- The installer has encountered
an unexpected error installing this package. This may indicate a problem with this
package. The error code is 2350. The arguments are: , ,

Error - 1/26/2012 3:14:38 PM | Computer Name = D6KK1Z81 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/26/2012 3:18:27 PM | Computer Name = D6KK1Z81 | Source = Application Hang | ID = 1002
Description = Hanging application iexplore.exe, version 8.0.6001.18702, hang module
hungapp, version 0.0.0.0, hang address 0x00000000.

Error - 1/26/2012 3:21:50 PM | Computer Name = D6KK1Z81 | Source = Application Hang | ID = 1001
Description = Fault bucket 1180947459.

Error - 1/26/2012 3:33:31 PM | Computer Name = D6KK1Z81 | Source = .NET Runtime Optimization Service | ID = 1111
Description = .NET Runtime Optimization Service (clr_optimization_v2.0.50727_32)
- Service reached limit of transient errors. Will shut down. Last error returned
from Service Manager: 0x80029c4a.

[ System Events ]
Error - 12/30/2011 12:20:20 AM | Computer Name = D6KK1Z81 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 12/30/2011 12:20:23 AM | Computer Name = D6KK1Z81 | Source = SideBySide | ID = 16842784
Description = Dependent Assembly Microsoft.VC80.MFCLOC could not be found and Last
Error was The referenced assembly is not installed on your system.

Error - 12/30/2011 12:20:23 AM | Computer Name = D6KK1Z81 | Source = SideBySide | ID = 16842811
Description = Resolve Partial Assembly failed for Microsoft.VC80.MFCLOC. Reference
error message: The referenced assembly is not installed on your system. .

Error - 12/30/2011 12:20:23 AM | Computer Name = D6KK1Z81 | Source = SideBySide | ID = 16842811
Description = Generate Activation Context failed for C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\MFC80.DLL.
Reference
error message: The operation completed successfully. .

Error - 1/1/2012 5:45:12 PM | Computer Name = D6KK1Z81 | Source = DCOM | ID = 10010
Description = The server {66B093B7-B5E3-4CFE-B32B-FEB55F172481} did not register
with DCOM within the required timeout.

Error - 1/1/2012 6:01:41 PM | Computer Name = D6KK1Z81 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IHA_MessageCenter service
to connect.

Error - 1/1/2012 6:01:41 PM | Computer Name = D6KK1Z81 | Source = Service Control Manager | ID = 7000
Description = The IHA_MessageCenter service failed to start due to the following
error: %%1053

Error - 1/26/2012 2:36:02 AM | Computer Name = D6KK1Z81 | Source = Service Control Manager | ID = 7009
Description = Timeout (30000 milliseconds) waiting for the IHA_MessageCenter service
to connect.

Error - 1/26/2012 2:36:02 AM | Computer Name = D6KK1Z81 | Source = Service Control Manager | ID = 7000
Description = The IHA_MessageCenter service failed to start due to the following
error: %%1053

Error - 1/26/2012 2:53:45 PM | Computer Name = D6KK1Z81 | Source = DCOM | ID = 10010
Description = The server {66B093B7-B5E3-4CFE-B32B-FEB55F172481} did not register
with DCOM within the required timeout.


< End of report >
deltalima
January 28, 2012, 3:02 PM UTC
Hi xyonist,

so I will post those logs for you now and continue to try to run GMER successfully until I hear back from you.


Please run this alternative scan instead of GMER.

Scan With RKUnHooker

  • Please Download Rootkit Unhooker Save it to your desktop.
  • Now double-click on RKUnhookerLE.exe to run it.
  • Click the Report tab, then click Scan.
  • Check (Tick) Drivers, Stealth, Files, Code Hooks. Uncheck the rest. then Click OK.
  • Wait till the scanner has finished and then click File, Save Report.
  • Save the report somewhere where you can find it. Click Close.
  • Copy the entire contents of the report and paste it in a reply here.


Run OTL Script

  • Double-click OTL.exe to start the program.
  • Copy and Paste the following code into the textbox. Do not include the word Code

    
:processes
    
killallprocesses
    
:otl
    
O2 - BHO: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    
O3 - HKLM\..\Toolbar: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    
O3 - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\..\Toolbar\WebBrowser: (no name) - {9D425283-D487-4337-BAB6-AB8354A81457} - No CLSID value found.
    
O3 - HKU\S-1-5-21-2648800068-1536023876-680085538-1006\..\Toolbar\WebBrowser: (no name) - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No CLSID value found.
    
:reg
    
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]
    
"DisableMonitoring" = 0
    
:commands
    
[EMPTYTEMP]
    
[EMPTYFLASH]
    
[EMPTYJAVA]
    
[RESETHOSTS]
    
[REBOOT]
  • Then click the Run Fix button at the top.
  • Click .
  • OTL may ask to reboot the machine. Please do so if asked.
  • The report should appear in Notepad after the reboot.Copy and Paste that report in your next reply.


Update Adobe Reader

  • You should Download and Install the newest version of Adobe Reader for reading pdf files.
  • Older versions may have vulnerabilities that malware can use to infect your system.
  • Go Here to download and install Adobe Reader X (10.1.1).
  • Note: remember to Uncheck Free McAfee® Security Scan Plus (optional)


Update Java Runtime

You are using an old version of Java. Sun's Java is sometimes updated in order to eliminate the exploitation of vulnerabilities in an existing version. For this reason, it's extremely important that you keep the program up to date, & also remove the older more vulnerable versions from your system. The most current version of Sun Java is: Java Runtime Environment Version 6 Update 30.
  • Download the latest version of Java Runtime Environment (JRE) 6 Here
  • Scroll down to where it says "JDK 6 Update 30 (JDK or JRE)"
  • Click the orange Download JRE button to the right
  • Select the Windows platform from the dropdown menu
  • Read the License Agreement and then check the box that says: "I agree to the Java SE Runtime Environment 6 with JavaFX License Agreement". Click on Continue.The page will refresh
  • Click on the link to download Windows Offline Installation & save the file to your desktop
  • Close any programs you may have running - especially your web browser
  • Go to Start > Settings > Control Panel, double-click on Add/Remove Programs & remove all older versions of Java
  • Check (highlight) any item with Java Runtime Environment (JRE or J2SE or Java(TM) 6) in the name
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions
  • Reboot your computer once all Java components are removed
  • Then from your desktop double-click on jre-6u30-windows-i586-p.exe to install the newest version



253.98 Mb Total Physical Memory


That is a cause of the computer running slowly, XP needs at least twice that to function and realically needs 1 GB to perform as it should.
You need to increase the amount ot RAM.
xyonist
January 28, 2012, 8:07 PM UTC
Hi Deltalima,

I was able to successfully run RKUnHooker and the OTL Script as well as update Adobe Reader and Java. Here are the logs:

Report:

RkU Version: 3.8.389.593, Type LE (SR2)
==============================================
OS Name: Windows XP
Version 5.1.2600 (Service Pack 3)
Number of processors #1
==============================================
>Drivers
==============================================
0x804D7000 C:\WINDOWS\system32\ntoskrnl.exe 2192768 bytes (Microsoft Corporation, NT Kernel & System)
0x804D7000 PnpManager 2192768 bytes
0x804D7000 RAW 2192768 bytes
0x804D7000 WMIxWDM 2192768 bytes
0xBF800000 Win32k 1859584 bytes
0xBF800000 C:\WINDOWS\System32\win32k.sys 1859584 bytes (Microsoft Corporation, Multi-User Win32 Driver)
0xF8087000 C:\WINDOWS\system32\DRIVERS\ialmnt5.sys 1302528 bytes (Intel Corporation, Intel Graphics Miniport Driver)
0xF7EF9000 C:\WINDOWS\system32\DRIVERS\HSF_DP.sys 1044480 bytes (Conexant Systems, Inc., HSF_DP driver)
0xBF077000 C:\WINDOWS\System32\ialmdd5.DLL 925696 bytes (Intel Corporation, DirectDraw(R) Driver for Intel(R) Graphics Technology)
0xF7D01000 C:\WINDOWS\system32\drivers\senfilt.sys 733184 bytes (Creative Technology Ltd., Creative WDM Audio Driver)
0xF7E52000 C:\WINDOWS\system32\DRIVERS\HSF_CNXT.sys 684032 bytes (Conexant Systems, Inc., HSF_CNXT driver)
0xF9159000 Ntfs.sys 577536 bytes (Microsoft Corporation, NT File System Driver)
0xBA545000 C:\WINDOWS\system32\DRIVERS\mrxsmb.sys 458752 bytes (Microsoft Corporation, Windows NT SMB Minirdr)
0xB9FE4000 C:\WINDOWS\System32\Drivers\aswSnx.SYS 446464 bytes (AVAST Software, avast! Virtualization Driver)
0xF7C7B000 C:\WINDOWS\system32\DRIVERS\update.sys 385024 bytes (Microsoft Corporation, Update Driver)
0xBA742000 C:\WINDOWS\system32\DRIVERS\tcpip.sys 364544 bytes (Microsoft Corporation, TCP/IP Protocol Driver)
0xB3D02000 C:\WINDOWS\system32\DRIVERS\srv.sys 360448 bytes (Microsoft Corporation, Server driver)
0xBA079000 C:\WINDOWS\System32\Drivers\aswSP.SYS 307200 bytes (AVAST Software, avast! self protection module)
0xBF159000 C:\WINDOWS\System32\ATMFD.DLL 290816 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver)
0xB3D82000 C:\WINDOWS\System32\Drivers\HTTP.sys 266240 bytes (Microsoft Corporation, HTTP Protocol Stack)
0xF7DD8000 C:\WINDOWS\system32\drivers\smwdm.sys 262144 bytes (Analog Devices, Inc., SoundMAX Integrated Digital Audio )
0xBF042000 C:\WINDOWS\System32\ialmdev5.DLL 217088 bytes (Intel Corporation, Component GHAL Driver)
0xF801B000 C:\WINDOWS\system32\DRIVERS\HSFHWBS2.sys 212992 bytes (Conexant Systems, Inc., HSF_HWB2 WDM driver)
0xF9277000 ACPI.sys 188416 bytes (Microsoft Corporation, ACPI Driver for NT)
0xB3E8B000 C:\WINDOWS\system32\DRIVERS\mrxdav.sys 184320 bytes (Microsoft Corporation, Windows NT WebDav Minirdr)
0xF912C000 NDIS.sys 184320 bytes (Microsoft Corporation, NDIS 5.1 wrapper driver)
0xB333E000 C:\WINDOWS\system32\drivers\kmixer.sys 176128 bytes (Microsoft Corporation, Kernel Mode Audio Mixer)
0xBA5DD000 C:\WINDOWS\system32\DRIVERS\rdbss.sys 176128 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver)
0xBA71A000 C:\WINDOWS\system32\DRIVERS\netbt.sys 163840 bytes (Microsoft Corporation, MBT Transport driver)
0xF7E2C000 C:\WINDOWS\system32\DRIVERS\e100b325.sys 155648 bytes (Intel Corporation, Intel(R) PRO/100 Adapter NDIS 5.1 driver)
0xBA51F000 C:\WINDOWS\system32\DRIVERS\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator)
0xF7DB4000 C:\WINDOWS\system32\drivers\portcls.sys 147456 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices))
0xF804F000 C:\WINDOWS\system32\DRIVERS\USBPORT.SYS 147456 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver)
0xF7FF8000 C:\WINDOWS\system32\DRIVERS\ks.sys 143360 bytes (Microsoft Corporation, Kernel CSA Library)
0xBA6A8000 C:\WINDOWS\System32\drivers\afd.sys 139264 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock)
0xBF020000 C:\WINDOWS\System32\ialmdnt5.dll 139264 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0x806EF000 ACPI_HAL 131840 bytes
0x806EF000 C:\WINDOWS\system32\hal.dll 131840 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL)
0xF920F000 fltmgr.sys 131072 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager)
0xF9247000 ftdisk.sys 126976 bytes (Microsoft Corporation, FT Disk Driver)
0xB45B9000 C:\WINDOWS\System32\Drivers\aswMon2.SYS 106496 bytes (AVAST Software, avast! File System Filter Driver for Windows XP)
0xF9112000 Mup.sys 106496 bytes (Microsoft Corporation, Multiple UNC Provider driver)
0xF922F000 atapi.sys 98304 bytes (Microsoft Corporation, IDE/ATAPI Port Driver)
0xB45FB000 C:\WINDOWS\System32\Drivers\dump_atapi.sys 98304 bytes
0xF91E6000 KSecDD.sys 94208 bytes (Microsoft Corporation, Kernel Security Support Provider Interface)
0xF7CEA000 C:\WINDOWS\system32\DRIVERS\ndiswan.sys 94208 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption))
0xB3FFE000 C:\WINDOWS\system32\drivers\wdmaud.sys 86016 bytes (Microsoft Corporation, MMSYSTEM Wave/Midi API mapper)
0xF7E18000 C:\WINDOWS\system32\DRIVERS\parport.sys 81920 bytes (Microsoft Corporation, Parallel Port Driver)
0xF8073000 C:\WINDOWS\system32\DRIVERS\VIDEOPRT.SYS 81920 bytes (Microsoft Corporation, Video Port Driver)
0xBA79B000 C:\WINDOWS\system32\DRIVERS\ipsec.sys 77824 bytes (Microsoft Corporation, IPSec Driver)
0xBF000000 C:\WINDOWS\System32\drivers\dxg.sys 73728 bytes (Microsoft Corporation, DirectX Graphics Driver)
0xF91FD000 sr.sys 73728 bytes (Microsoft Corporation, System Restore Filesystem Filter Driver)
0xF9266000 pci.sys 69632 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator)
0xF7CD9000 C:\WINDOWS\system32\DRIVERS\psched.sys 69632 bytes (Microsoft Corporation, MS QoS Packet Scheduler)
0xB5797000 C:\WINDOWS\System32\Drivers\Cdfs.SYS 65536 bytes (Microsoft Corporation, CD-ROM File System Driver)
0xF9526000 C:\WINDOWS\system32\DRIVERS\cdrom.sys 65536 bytes (Microsoft Corporation, SCSI CD-ROM Driver)
0xF9516000 C:\WINDOWS\system32\DRIVERS\serial.sys 65536 bytes (Microsoft Corporation, Serial Device Driver)
0xF9346000 C:\WINDOWS\system32\drivers\drmk.sys 61440 bytes (Microsoft Corporation, Microsoft Kernel DRM Descrambler Filter)
0xF9536000 C:\WINDOWS\system32\DRIVERS\redbook.sys 61440 bytes (Microsoft Corporation, Redbook Audio Filter Driver)
0xB40AB000 C:\WINDOWS\system32\drivers\sysaudio.sys 61440 bytes (Microsoft Corporation, System Audio WDM Filter)
0xF8215000 C:\WINDOWS\system32\DRIVERS\usbhub.sys 61440 bytes (Microsoft Corporation, Default Hub Driver for USB)
0xBF012000 C:\WINDOWS\System32\ialmrnt5.dll 57344 bytes (Intel Corporation, Controller Hub for Intel Graphics Driver)
0xF9306000 C:\WINDOWS\system32\DRIVERS\CLASSPNP.SYS 53248 bytes (Microsoft Corporation, SCSI Class System Dll)
0xF9356000 C:\WINDOWS\system32\DRIVERS\rasl2tp.sys 53248 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver)
0xF92E6000 VolSnap.sys 53248 bytes (Microsoft Corporation, Volume Shadow Copy Driver)
0xF9376000 C:\WINDOWS\system32\DRIVERS\raspptp.sys 49152 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol)
0xED87D000 C:\WINDOWS\System32\Drivers\aswTdi.SYS 45056 bytes (AVAST Software, avast! TDI Filter Driver)
0xED85D000 C:\WINDOWS\System32\Drivers\Fips.SYS 45056 bytes (Microsoft Corporation, FIPS Crypto Driver)
0xF9336000 C:\WINDOWS\system32\DRIVERS\imapi.sys 45056 bytes (Microsoft Corporation, IMAPI Kernel Driver)
0xF92D6000 MountMgr.sys 45056 bytes (Microsoft Corporation, Mount Manager)
0xF9366000 C:\WINDOWS\system32\DRIVERS\raspppoe.sys 45056 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver)
0xF92C6000 isapnp.sys 40960 bytes (Microsoft Corporation, PNP ISA Bus Driver)
0xF8245000 C:\WINDOWS\System32\Drivers\NDProxy.SYS 40960 bytes (Microsoft Corporation, NDIS Proxy)
0xB3E53000 C:\WINDOWS\system32\DRIVERS\secdrv.sys 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver)
0xF9396000 C:\WINDOWS\system32\DRIVERS\termdd.sys 40960 bytes (Microsoft Corporation, Terminal Server Driver)
0xB38B2000 C:\WINDOWS\System32\Drivers\BlackBox.SYS 36864 bytes (RKU Driver)
0xF92F6000 disk.sys 36864 bytes (Microsoft Corporation, PnP Disk Driver)
0xEDE2B000 C:\WINDOWS\system32\DRIVERS\HIDCLASS.SYS 36864 bytes (Microsoft Corporation, Hid Class Library)
0xF9506000 C:\WINDOWS\system32\DRIVERS\intelppm.sys 36864 bytes (Microsoft Corporation, Processor Device Driver)
0xF9386000 C:\WINDOWS\system32\DRIVERS\msgpc.sys 36864 bytes (Microsoft Corporation, MS General Packet Classifier)
0xED86D000 C:\WINDOWS\system32\DRIVERS\netbios.sys 36864 bytes (Microsoft Corporation, NetBIOS interface driver)
0xF9316000 PxHelp20.sys 36864 bytes (Sonic Solutions, Px Engine Device Driver for Windows 2000/XP)
0xED84D000 C:\WINDOWS\system32\DRIVERS\wanarp.sys 36864 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver)
0xF95DE000 C:\WINDOWS\System32\Drivers\Modem.SYS 32768 bytes (Microsoft Corporation, Modem Device Driver)
0xEEB61000 C:\WINDOWS\System32\Drivers\Npfs.SYS 32768 bytes (Microsoft Corporation, NPFS Driver)
0xF95D6000 C:\WINDOWS\system32\DRIVERS\usbehci.sys 32768 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver)
0xEEB59000 C:\WINDOWS\System32\Drivers\aswRdr.SYS 28672 bytes (AVAST Software, avast! TDI RDR Driver)
0xF958E000 C:\WINDOWS\system32\DRIVERS\HIDPARSE.SYS 28672 bytes (Microsoft Corporation, Hid Parsing Library)
0xF9546000 C:\WINDOWS\system32\DRIVERS\PCIIDEX.SYS 28672 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension)
0xED4AF000 C:\WINDOWS\System32\Drivers\Aavmker4.SYS 24576 bytes (AVAST Software, avast! Base Kernel-Mode Device Driver for Windows NT/2000/XP)
0xF95FE000 C:\WINDOWS\system32\DRIVERS\kbdclass.sys 24576 bytes (Microsoft Corporation, Keyboard Class Driver)
0xF9606000 C:\WINDOWS\system32\DRIVERS\mouclass.sys 24576 bytes (Microsoft Corporation, Mouse Class Driver)
0xF95CE000 C:\WINDOWS\system32\DRIVERS\usbuhci.sys 24576 bytes (Microsoft Corporation, UHCI USB Miniport Driver)
0xF95C6000 C:\WINDOWS\System32\drivers\vga.sys 24576 bytes (Microsoft Corporation, VGA/Super VGA Video Driver)
0xF95BE000 C:\WINDOWS\System32\Drivers\Msfs.SYS 20480 bytes (Microsoft Corporation, Mailslot driver)
0xF954E000 PartMgr.sys 20480 bytes (Microsoft Corporation, Partition Manager)
0xF95EE000 C:\WINDOWS\system32\DRIVERS\ptilink.sys 20480 bytes (Parallel Technologies, Inc., Parallel Technologies DirectParallel IO Library)
0xF95F6000 C:\WINDOWS\system32\DRIVERS\raspti.sys 20480 bytes (Microsoft Corporation, PTI DirectParallel(R) mini-port/call-manager driver)
0xF95E6000 C:\WINDOWS\system32\DRIVERS\TDI.SYS 20480 bytes (Microsoft Corporation, TDI Wrapper)
0xB52F6000 C:\WINDOWS\System32\watchdog.sys 20480 bytes (Microsoft Corporation, Watchdog Driver)
0xEDDEF000 C:\WINDOWS\system32\DRIVERS\kbdhid.sys 16384 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF97BE000 C:\WINDOWS\system32\drivers\MODEMCSA.sys 16384 bytes (Microsoft Corporation, Unimodem CSA Filter)
0xF9756000 C:\WINDOWS\system32\DRIVERS\mssmbios.sys 16384 bytes (Microsoft Corporation, System Management BIOS Driver)
0xF97B6000 C:\WINDOWS\system32\DRIVERS\ndisuio.sys 16384 bytes (Microsoft Corporation, NDIS User mode I/O Driver)
0xF8805000 C:\WINDOWS\system32\DRIVERS\serenum.sys 16384 bytes (Microsoft Corporation, Serial Port Enumerator)
0xBA051000 C:\WINDOWS\System32\Drivers\aswFsBlk.SYS 12288 bytes (AVAST Software, avast! File System Access Blocking Driver)
0xF96D6000 C:\WINDOWS\system32\BOOTVID.dll 12288 bytes (Microsoft Corporation, VGA Boot Driver)
0xB533C000 C:\WINDOWS\System32\drivers\Dxapi.sys 12288 bytes (Microsoft Corporation, DirectX API Driver)
0xF775A000 C:\WINDOWS\system32\DRIVERS\hidusb.sys 12288 bytes (Microsoft Corporation, USB Miniport Driver for Input Devices)
0xF8811000 C:\WINDOWS\System32\Drivers\i2omgmt.SYS 12288 bytes (Microsoft Corporation, I2O Utility Filter)
0xB3D7E000 C:\WINDOWS\system32\DRIVERS\mdmxsdk.sys 12288 bytes (Conexant, Diagnostic Interface DRIVER)
0xEF274000 C:\WINDOWS\system32\DRIVERS\mouhid.sys 12288 bytes (Microsoft Corporation, HID Mouse Filter Driver)
0xF87F9000 C:\WINDOWS\system32\DRIVERS\ndistapi.sys 12288 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver)
0xEF298000 C:\WINDOWS\system32\DRIVERS\rasacd.sys 12288 bytes (Microsoft Corporation, RAS Automatic Connection Driver)
0xF9852000 C:\WINDOWS\System32\Drivers\Beep.SYS 8192 bytes (Microsoft Corporation, BEEP Driver)
0xF97DE000 C:\WINDOWS\system32\DRIVERS\dsunidrv.sys 8192 bytes (Gteko Ltd., GUniDriver)
0xF981C000 C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS 8192 bytes
0xF9850000 C:\WINDOWS\System32\Drivers\Fs_Rec.SYS 8192 bytes (Microsoft Corporation, File System Recognizer Driver)
0xF97CA000 intelide.sys 8192 bytes (Microsoft Corporation, Intel PCI IDE Driver)
0xF97C6000 C:\WINDOWS\system32\KDCOM.DLL 8192 bytes (Microsoft Corporation, Kernel Debugger HW Extension DLL)
0xF9854000 C:\WINDOWS\System32\Drivers\mnmdd.SYS 8192 bytes (Microsoft Corporation, Frame buffer simulator)
0xF9856000 C:\WINDOWS\System32\DRIVERS\RDPCDD.sys 8192 bytes (Microsoft Corporation, RDP Miniport)
0xF97F6000 C:\WINDOWS\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator)
0xF9824000 C:\WINDOWS\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver)
0xF97C8000 C:\WINDOWS\system32\DRIVERS\WMILIB.SYS 8192 bytes (Microsoft Corporation, WMILIB WMI support library Dll)
0xF9899000 C:\WINDOWS\system32\DRIVERS\audstub.sys 4096 bytes (Microsoft Corporation, AudStub Driver)
0xB98FB000 C:\WINDOWS\System32\drivers\dxgthk.sys 4096 bytes (Microsoft Corporation, DirectX Graphics Driver Thunk)
0xF8F86000 C:\WINDOWS\System32\Drivers\Null.SYS 4096 bytes (Microsoft Corporation, NULL Driver)
0xF988E000 pciide.sys 4096 bytes (Microsoft Corporation, Generic PCI IDE Bus Driver)
==============================================
>Stealth
==============================================
WARNING: Virus alike driver modification [bthpan.sys]
WARNING: Virus alike driver modification [adpu160m.sys]
WARNING: Virus alike driver modification [sffp_mmc.sys]
WARNING: Virus alike driver modification [hsfdpsp2.sys]
WARNING: Virus alike driver modification [atinrvxx.sys]
WARNING: Virus alike driver modification [sffp_sd.sys]
WARNING: Virus alike driver modification [irenum.sys]
WARNING: Virus alike driver modification [wadv08nt.sys]
WARNING: Virus alike driver modification [ati1mdxx.sys]
WARNING: Virus alike driver modification [acpiec.sys]
WARNING: Virus alike driver modification [cpqdap01.sys]
WARNING: Virus alike driver modification [wadv07nt.sys]
WARNING: Virus alike driver modification [wadv09nt.sys]
WARNING: Virus alike driver modification [sffdisk.sys]
WARNING: Virus alike driver modification [wadv11nt.sys]
WARNING: Virus alike driver modification [pcmcia.sys]
WARNING: Virus alike driver modification [amsint.sys]
WARNING: Virus alike driver modification [nikedrv.sys]
WARNING: Virus alike driver modification [rio8drv.sys]
WARNING: Virus alike driver modification [riodrv.sys]
WARNING: Virus alike driver modification [ws2ifsl.sys]
WARNING: Virus alike driver modification [tdpipe.sys]
WARNING: Virus alike driver modification [ati1pdxx.sys]
WARNING: Virus alike driver modification [fsvga.sys]
WARNING: Virus alike driver modification [usbvideo.sys]
WARNING: Virus alike driver modification [tunmp.sys]
WARNING: Virus alike driver modification [nwlnkflt.sys]
WARNING: Virus alike driver modification [ftdisk.sys]
WARNING: Virus alike driver modification [mtlmnt5.sys]
WARNING: Virus alike driver modification [mutohpen.sys]
WARNING: Virus alike driver modification [aha154x.sys]
WARNING: Virus alike driver modification [usb8023.sys]
WARNING: Virus alike driver modification [usb8023x.sys]
WARNING: Virus alike driver modification [slnt7554.sys]
WARNING: Virus alike driver modification [fltmgr.sys]
WARNING: Virus alike driver modification [mtlstrm.sys]
WARNING: Virus alike driver modification [slwdmsup.sys]
WARNING: Virus alike driver modification [recagent.sys]
WARNING: Virus alike driver modification [atinmdxx.sys]
WARNING: Virus alike driver modification [atinttxx.sys]
WARNING: Virus alike driver modification [cbidf2k.sys]
WARNING: Virus alike driver modification [diskdump.sys]
WARNING: Virus alike driver modification [wacompen.sys]
WARNING: Virus alike driver modification [asyncmac.sys]
WARNING: Virus alike driver modification [atinpdxx.sys]
WARNING: Virus alike driver modification [hdaudbus.sys]
WARNING: Virus alike driver modification [smclib.sys]
WARNING: Virus alike driver modification [dac960nt.sys]
WARNING: Virus alike driver modification [asc3550.sys]
WARNING: Virus alike driver modification [cpqarray.sys]
WARNING: Virus alike driver modification [tape.sys]
WARNING: Virus alike driver modification [dmio.sys]
WARNING: Virus alike driver modification [usbintel.sys]
WARNING: Virus alike driver modification [ini910u.sys]
WARNING: Virus alike driver modification [symc810.sys]
WARNING: Virus alike driver modification [s3gnbm.sys]
WARNING: Virus alike driver modification [bthenum.sys]
WARNING: Virus alike driver modification [mraid35x.sys]
WARNING: Virus alike driver modification [dac2w2k.sys]
WARNING: Virus alike driver modification [ntmtlfax.sys]
WARNING: Virus alike driver modification [ndis.sys]
WARNING: Virus alike driver modification [i2omp.sys]
WARNING: Virus alike driver modification [acpi.sys]
WARNING: Virus alike driver modification [bthusb.sys]
WARNING: Virus alike driver modification [nv4_mini.sys]
WARNING: Virus alike driver modification [sparrow.sys]
WARNING: Virus alike driver modification [hidir.sys]
WARNING: Virus alike driver modification [iqvw32.sys]
WARNING: Virus alike driver modification [rdpdr.sys]
WARNING: Virus alike driver modification [partmgr.sys]
WARNING: Virus alike driver modification [dpti2o.sys]
WARNING: Virus alike driver modification [rmcast.sys]
WARNING: Virus alike driver modification [flpydisk.sys]
WARNING: Virus alike driver modification [ipinip.sys]
WARNING: Virus alike driver modification [ati1ttxx.sys]
WARNING: Virus alike driver modification [tsbvcap.sys]
WARNING: Virus alike driver modification [tdtcp.sys]
WARNING: Virus alike driver modification [hsfbs2s2.sys]
WARNING: Virus alike driver modification [watv06nt.sys]
WARNING: Virus alike driver modification [asc3350p.sys]
WARNING: Virus alike driver modification [ABP480N5.SYS]
WARNING: Virus alike driver modification [pciidex.sys]
WARNING: Virus alike driver modification [sonydcam.sys]
WARNING: Virus alike driver modification [watv10nt.sys]
WARNING: Virus alike driver modification [hidbth.sys]
WARNING: Virus alike driver modification [usbcamd.sys]
WARNING: Virus alike driver modification [usbcamd2.sys]
WARNING: Virus alike driver modification [usbprint.sys]
WARNING: Virus alike driver modification [hpn.sys]
WARNING: Virus alike driver modification [cinemst2.sys]
WARNING: Virus alike driver modification [ati1snxx.sys]
WARNING: Virus alike driver modification [asc.sys]
WARNING: Virus alike driver modification [bthport.sys]
WARNING: Virus alike driver modification [perc2.sys]
WARNING: Virus alike driver modification [fdc.sys]
WARNING: Virus alike driver modification [sym_hi.sys]
WARNING: Virus alike driver modification [atinsnxx.sys]
WARNING: Virus alike driver modification [ati1xbxx.sys]
WARNING: Virus alike driver modification [rndismp.sys]
WARNING: Virus alike driver modification [rndismpx.sys]
WARNING: Virus alike driver modification [ati1raxx.sys]
WARNING: Virus alike driver modification [sym_u3.sys]
WARNING: Virus alike driver modification [atmepvc.sys]
WARNING: Virus alike driver modification [atinxbxx.sys]
WARNING: Virus alike driver modification [nwlnkfwd.sys]
WARNING: Virus alike driver modification [symc8xx.sys]
WARNING: Virus alike driver modification [ati2mtaa.sys]
WARNING: Virus alike driver modification [ipfltdrv.sys]
WARNING: Virus alike driver modification [ql10wnt.sys]
WARNING: Virus alike driver modification [rawwan.sys]
WARNING: Virus alike driver modification [ati1xsxx.sys]
WARNING: Virus alike driver modification [atmuni.sys]
WARNING: Virus alike driver modification [processr.sys]
WARNING: Virus alike driver modification [disk.sys]
WARNING: Virus alike driver modification [ati1tuxx.sys]
WARNING: Virus alike driver modification [bthprint.sys]
WARNING: Virus alike driver modification [ip6fw.sys]
WARNING: Virus alike driver modification [crusoe.sys]
WARNING: Virus alike driver modification [ultra.sys]
WARNING: Virus alike driver modification [isapnp.sys]
WARNING: Virus alike driver modification [amdk6.sys]
WARNING: Virus alike driver modification [amdk7.sys]
WARNING: Virus alike driver modification [bthmodem.sys]
WARNING: Virus alike driver modification [wpdusb.sys]
WARNING: Virus alike driver modification [nmnt.sys]
WARNING: Virus alike driver modification [ql1080.sys]
WARNING: Virus alike driver modification [ql1240.sys]
WARNING: Virus alike driver modification [slntamr.sys]
WARNING: Virus alike driver modification [sisagp.sys]
WARNING: Virus alike driver modification [viaagp.sys]
WARNING: Virus alike driver modification [agp440.sys]
WARNING: Virus alike driver modification [mountmgr.sys]
WARNING: Virus alike driver modification [alim1541.sys]
WARNING: Virus alike driver modification [p3.sys]
WARNING: Virus alike driver modification [amdagp.sys]
WARNING: Virus alike driver modification [uagp35.sys]
WARNING: Virus alike driver modification [agpcpq.sys]
WARNING: Virus alike driver modification [mtxparhm.sys]
WARNING: Virus alike driver modification [ql12160.sys]
WARNING: Virus alike driver modification [gagp30kx.sys]
WARNING: Virus alike driver modification [ql1280.sys]
WARNING: Virus alike driver modification [stream.sys]
WARNING: Virus alike driver modification [classpnp.sys]
WARNING: Virus alike driver modification [mspqm.sys]
WARNING: Virus alike driver modification [toside.sys]
WARNING: Virus alike driver modification [tosdvd.sys]
WARNING: Virus alike driver modification [atinraxx.sys]
WARNING: Virus alike driver modification [volsnap.sys]
WARNING: Virus alike driver modification [aliide.sys]
WARNING: Virus alike driver modification [mspclock.sys]
WARNING: Virus alike driver modification [viaide.sys]
WARNING: Virus alike driver modification [intelide.sys]
WARNING: Virus alike driver modification [perc2hib.sys]
WARNING: Virus alike driver modification [aic78u2.sys]
WARNING: Virus alike driver modification [atmlane.sys]
WARNING: Virus alike driver modification [nwlnkspx.sys]
WARNING: Virus alike driver modification [ati1btxx.sys]
WARNING: Virus alike driver modification [aic78xx.sys]
WARNING: Virus alike driver modification [ntfs.sys]
WARNING: Virus alike driver modification [atinbtxx.sys]
WARNING: Virus alike driver modification [vdmindvd.sys]
WARNING: Virus alike driver modification [dmload.sys]
WARNING: Virus alike driver modification [rootmdm.sys]
WARNING: Virus alike driver modification [smbali.sys]
WARNING: Virus alike driver modification [rfcomm.sys]
WARNING: Virus alike driver modification [atmarpc.sys]
WARNING: Virus alike driver modification [arp1394.sys]
WARNING: Virus alike driver modification [nic1394.sys]
WARNING: Virus alike driver modification [nwlnknb.sys]
WARNING: Virus alike driver modification [atinxsxx.sys]
WARNING: Virus alike driver modification [ati1rvxx.sys]
WARNING: Virus alike driver modification [mf.sys]
WARNING: Virus alike driver modification [udfs.sys]
WARNING: Virus alike driver modification [cmdide.sys]
WARNING: Virus alike driver modification [parvdm.sys]
WARNING: Virus alike driver modification [pci.sys]
WARNING: Virus alike driver modification [hsfcxts2.sys]
WARNING: Virus alike driver modification [ati2mtag.sys]
WARNING: Virus alike driver modification [bridge.sys]
WARNING: Virus alike driver modification [atintuxx.sys]
WARNING: Virus alike driver modification [sr.sys]
WARNING: Virus alike driver modification [mskssrv.sys]
WARNING: Virus alike driver modification [cd20xrnt.sys]
WARNING: Virus alike driver modification [mcd.sys]
WARNING: Virus alike driver modification [WudfPf.sys]
WARNING: Virus alike driver modification [sdbus.sys]
WARNING: Virus alike driver modification [dmboot.sys]
WARNING: Virus alike driver modification [WudfRd.sys]
WARNING: Virus alike driver modification [nwlnkipx.sys]
WARNING: Virus alike driver modification [ksecdd.sys]
WARNING: Virus alike driver modification [slnthal.sys]
WARNING: Virus alike driver modification [scsiport.sys]
==============================================
>Files
==============================================
==============================================
>Hooks
==============================================
ntoskrnl.exe+0x00004AA2, Type: Inline - RelativeJump 0x804DBAA2-->804DBAA9 [ntoskrnl.exe]
ntoskrnl.exe+0x0000B790, Type: Inline - RelativeJump 0x804E2790-->804E272B [ntoskrnl.exe]
ntoskrnl.exe+0x0000B7AC, Type: Inline - RelativeCall 0x804E27AC-->94082720 [unknown_code_page]
ntoskrnl.exe+0x0000B874, Type: Inline - RelativeJump 0x804E2874-->804E287E [ntoskrnl.exe]
ntoskrnl.exe+0x0000BA94, Type: Inline - RelativeJump 0x804E2A94-->804E2A48 [ntoskrnl.exe]
ntoskrnl.exe+0x0000BAE8, Type: Inline - RelativeJump 0x804E2AE8-->804E2B5E [ntoskrnl.exe]
ntoskrnl.exe-->NtCreateProcessEx, Type: Inline - RelativeJump 0x8058124C-->BA0977A6 [aswSP.SYS]
ntoskrnl.exe-->ObInsertObject, Type: Inline - RelativeJump 0x805650BA-->BA09615C [aswSP.SYS]
ntoskrnl.exe-->ObMakeTemporaryObject, Type: Inline - RelativeJump 0x805A038B-->BA09469C [aswSP.SYS]
[1068]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[1068]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[1068]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1068]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1068]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1068]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1068]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[1068]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[1068]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[1068]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[1068]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[1284]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[1284]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1284]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1284]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1284]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1284]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[1284]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[1284]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[1284]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[1284]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[1348]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[1348]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1348]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1348]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1348]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1348]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[1348]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[1348]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[1348]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[1348]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[1468]AvastSvc.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1468]AvastSvc.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Inline - PushRet 0x7C84495D-->EC900004 [unknown_code_page]
[1468]AvastSvc.exe-->kernel32.dll-->SetUnhandledExceptionFilter, Type: Code Mismatch 0x7C84495D + 3 [90]
[1468]AvastSvc.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[152]smax4pnp.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->003E0C0C [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->003E0E10 [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->003E0804 [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->003E0A08 [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003E01F8 [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003E03FC [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->003E0600 [unknown_code_page]
[152]smax4pnp.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->003E1014 [unknown_code_page]
[152]smax4pnp.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[152]smax4pnp.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[152]smax4pnp.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001501F8 [unknown_code_page]
[152]smax4pnp.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001503FC [unknown_code_page]
[152]smax4pnp.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->003F0600 [unknown_code_page]
[152]smax4pnp.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->003F0804 [unknown_code_page]
[152]smax4pnp.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003F01F8 [unknown_code_page]
[152]smax4pnp.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->003F0A08 [unknown_code_page]
[152]smax4pnp.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003F03FC [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002C0C0C [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002C0E10 [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002C0804 [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002C0A08 [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002C01F8 [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002C03FC [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002C0600 [unknown_code_page]
[1596]alg.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002C1014 [unknown_code_page]
[1596]alg.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1596]alg.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1596]alg.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1596]alg.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1596]alg.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002B0600 [unknown_code_page]
[1596]alg.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002B0804 [unknown_code_page]
[1596]alg.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002B01F8 [unknown_code_page]
[1596]alg.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002B0A08 [unknown_code_page]
[1596]alg.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002B03FC [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002C0C0C [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002C0E10 [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002C0804 [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002C0A08 [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002C01F8 [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002C03FC [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002C0600 [unknown_code_page]
[1608]explorer.exe-->advapi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77DD1218-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002C1014 [unknown_code_page]
[1608]explorer.exe-->crypt32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77A81188-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->gdi32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x77F110B4-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1608]explorer.exe-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x01001268-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->mswsock.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71A51178-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1608]explorer.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1608]explorer.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1608]explorer.exe-->shell32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7C9C15A4-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->user32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x7E41133C-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002D0600 [unknown_code_page]
[1608]explorer.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002D0804 [unknown_code_page]
[1608]explorer.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002D01F8 [unknown_code_page]
[1608]explorer.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002D0A08 [unknown_code_page]
[1608]explorer.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002D03FC [unknown_code_page]
[1608]explorer.exe-->wininet.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x3D9314B0-->5CB77774 [shimeng.dll]
[1608]explorer.exe-->ws2_32.dll-->kernel32.dll-->GetProcAddress, Type: IAT modification 0x71AB109C-->5CB77774 [shimeng.dll]
[1696]LEXBCES.EXE-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[1696]LEXBCES.EXE-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[1696]LEXBCES.EXE-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1696]LEXBCES.EXE-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1696]LEXBCES.EXE-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1696]LEXBCES.EXE-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1696]LEXBCES.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00380600 [unknown_code_page]
[1696]LEXBCES.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00380804 [unknown_code_page]
[1696]LEXBCES.EXE-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003801F8 [unknown_code_page]
[1696]LEXBCES.EXE-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00380A08 [unknown_code_page]
[1696]LEXBCES.EXE-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003803FC [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[1704]spoolsv.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[1704]spoolsv.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1704]spoolsv.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1704]spoolsv.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[1704]spoolsv.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[1704]spoolsv.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[1704]spoolsv.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[1704]spoolsv.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[1704]spoolsv.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[1704]spoolsv.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00380C0C [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00380E10 [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00380804 [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00380A08 [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003801F8 [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003803FC [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00380600 [unknown_code_page]
[1748]LEXPPS.EXE-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00381014 [unknown_code_page]
[1748]LEXPPS.EXE-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1748]LEXPPS.EXE-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1748]LEXPPS.EXE-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1748]LEXPPS.EXE-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1748]LEXPPS.EXE-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00390600 [unknown_code_page]
[1748]LEXPPS.EXE-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00390804 [unknown_code_page]
[1748]LEXPPS.EXE-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003901F8 [unknown_code_page]
[1748]LEXPPS.EXE-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00390A08 [unknown_code_page]
[1748]LEXPPS.EXE-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003903FC [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[1780]igfxpers.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[1780]igfxpers.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1780]igfxpers.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1780]igfxpers.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1780]igfxpers.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1780]igfxpers.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00380600 [unknown_code_page]
[1780]igfxpers.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00380804 [unknown_code_page]
[1780]igfxpers.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003801F8 [unknown_code_page]
[1780]igfxpers.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00380A08 [unknown_code_page]
[1780]igfxpers.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003803FC [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[1844]hkcmd.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[1844]hkcmd.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1844]hkcmd.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1844]hkcmd.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1844]hkcmd.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1844]hkcmd.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00380600 [unknown_code_page]
[1844]hkcmd.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00380804 [unknown_code_page]
[1844]hkcmd.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003801F8 [unknown_code_page]
[1844]hkcmd.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00380A08 [unknown_code_page]
[1844]hkcmd.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003803FC [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[1884]hpcmpmgr.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[1884]hpcmpmgr.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1884]hpcmpmgr.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1884]hpcmpmgr.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1884]hpcmpmgr.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1884]hpcmpmgr.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00380600 [unknown_code_page]
[1884]hpcmpmgr.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00380804 [unknown_code_page]
[1884]hpcmpmgr.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003801F8 [unknown_code_page]
[1884]hpcmpmgr.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00380A08 [unknown_code_page]
[1884]hpcmpmgr.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003803FC [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[1928]hpwuSchd.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[1928]hpwuSchd.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1928]hpwuSchd.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1928]hpwuSchd.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1928]hpwuSchd.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1928]hpwuSchd.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00380600 [unknown_code_page]
[1928]hpwuSchd.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00380804 [unknown_code_page]
[1928]hpwuSchd.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003801F8 [unknown_code_page]
[1928]hpwuSchd.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00380A08 [unknown_code_page]
[1928]hpwuSchd.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003803FC [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00380C0C [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00380E10 [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00380804 [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00380A08 [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003801F8 [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003803FC [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00380600 [unknown_code_page]
[1940]hphmon05.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00381014 [unknown_code_page]
[1940]hphmon05.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1940]hphmon05.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1940]hphmon05.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[1940]hphmon05.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[1940]hphmon05.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00390600 [unknown_code_page]
[1940]hphmon05.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00390804 [unknown_code_page]
[1940]hphmon05.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003901F8 [unknown_code_page]
[1940]hphmon05.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00390A08 [unknown_code_page]
[1940]hphmon05.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003903FC [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->003A0C0C [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->003A0E10 [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->003A0804 [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->003A0A08 [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003A01F8 [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003A03FC [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->003A0600 [unknown_code_page]
[1968]McciTrayApp.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->003A1014 [unknown_code_page]
[1968]McciTrayApp.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[1968]McciTrayApp.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[1968]McciTrayApp.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001501F8 [unknown_code_page]
[1968]McciTrayApp.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001503FC [unknown_code_page]
[1968]McciTrayApp.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00390600 [unknown_code_page]
[1968]McciTrayApp.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00390804 [unknown_code_page]
[1968]McciTrayApp.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003901F8 [unknown_code_page]
[1968]McciTrayApp.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00390A08 [unknown_code_page]
[1968]McciTrayApp.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003903FC [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[2084]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[2084]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2084]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2084]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[2084]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[2084]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[2084]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[2084]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[2084]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[2084]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[2192]Verizon_IHAMessageCenter.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2192]Verizon_IHAMessageCenter.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2380]jqs.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00390C0C [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00390E10 [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00390804 [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00390A08 [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003901F8 [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003903FC [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00390600 [unknown_code_page]
[2380]jqs.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00391014 [unknown_code_page]
[2380]jqs.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2380]jqs.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2380]jqs.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001501F8 [unknown_code_page]
[2380]jqs.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001503FC [unknown_code_page]
[2380]jqs.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->003A0600 [unknown_code_page]
[2380]jqs.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->003A0804 [unknown_code_page]
[2380]jqs.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003A01F8 [unknown_code_page]
[2380]jqs.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->003A0A08 [unknown_code_page]
[2380]jqs.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003A03FC [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->003A0C0C [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->003A0E10 [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->003A0804 [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->003A0A08 [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003A01F8 [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003A03FC [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->003A0600 [unknown_code_page]
[2564]McciCMService.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->003A1014 [unknown_code_page]
[2564]McciCMService.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2564]McciCMService.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2564]McciCMService.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001501F8 [unknown_code_page]
[2564]McciCMService.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001503FC [unknown_code_page]
[2564]McciCMService.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00390600 [unknown_code_page]
[2564]McciCMService.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00390804 [unknown_code_page]
[2564]McciCMService.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003901F8 [unknown_code_page]
[2564]McciCMService.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00390A08 [unknown_code_page]
[2564]McciCMService.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003903FC [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->003A0C0C [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->003A0E10 [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->003A0804 [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->003A0A08 [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003A01F8 [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003A03FC [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->003A0600 [unknown_code_page]
[256]AdobeARM.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->003A1014 [unknown_code_page]
[256]AdobeARM.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[256]AdobeARM.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[256]AdobeARM.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001501F8 [unknown_code_page]
[256]AdobeARM.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001503FC [unknown_code_page]
[256]AdobeARM.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->003B0600 [unknown_code_page]
[256]AdobeARM.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->003B0804 [unknown_code_page]
[256]AdobeARM.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003B01F8 [unknown_code_page]
[256]AdobeARM.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->003B0A08 [unknown_code_page]
[256]AdobeARM.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003B03FC [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00380C0C [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00380E10 [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00380804 [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00380A08 [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003801F8 [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003803FC [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00380600 [unknown_code_page]
[2592]HPZipm12.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00381014 [unknown_code_page]
[2592]HPZipm12.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2592]HPZipm12.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2592]HPZipm12.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->001401F8 [unknown_code_page]
[2592]HPZipm12.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->001403FC [unknown_code_page]
[2592]HPZipm12.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00390600 [unknown_code_page]
[2592]HPZipm12.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00390804 [unknown_code_page]
[2592]HPZipm12.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003901F8 [unknown_code_page]
[2592]HPZipm12.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00390A08 [unknown_code_page]
[2592]HPZipm12.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003903FC [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[2676]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[2676]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2676]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2676]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[2676]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[2676]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[2676]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[2676]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[2676]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[2676]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[2828]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[2828]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[2828]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[2828]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[2828]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[2828]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[2828]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[2828]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[2828]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[2828]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->00310C0C [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->00310E10 [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->00310804 [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->00310A08 [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->003101F8 [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->003103FC [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->00310600 [unknown_code_page]
[3116]searchindexer.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->00311014 [unknown_code_page]
[3116]searchindexer.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[3116]searchindexer.exe-->kernel32.dll-->WriteFile, Type: Inline - RelativeJump 0x7C810E27-->00585C0C [mssrch.dll]
[3116]searchindexer.exe-->kernel32.dll-->WriteFile, Type: Inline - SEH 0x7C810E2C [unknown_code_page]
[3116]searchindexer.exe-->kernel32.dll-->WriteFile, Type: Inline - SEH 0x7C810E2D [unknown_code_page]
[3116]searchindexer.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[3116]searchindexer.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000D01F8 [unknown_code_page]
[3116]searchindexer.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000D03FC [unknown_code_page]
[3116]searchindexer.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->00320600 [unknown_code_page]
[3116]searchindexer.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->00320804 [unknown_code_page]
[3116]searchindexer.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->003201F8 [unknown_code_page]
[3116]searchindexer.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->00320A08 [unknown_code_page]
[3116]searchindexer.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->003203FC [unknown_code_page]
[320]AvastUI.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[320]AvastUI.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[384]wscntfy.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[384]wscntfy.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[392]ctfmon.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002C0C0C [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002C0E10 [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002C0804 [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002C0A08 [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002C01F8 [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002C03FC [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002C0600 [unknown_code_page]
[392]ctfmon.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002C1014 [unknown_code_page]
[392]ctfmon.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[392]ctfmon.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[392]ctfmon.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000A01F8 [unknown_code_page]
[392]ctfmon.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000A03FC [unknown_code_page]
[392]ctfmon.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002D0600 [unknown_code_page]
[392]ctfmon.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002D0804 [unknown_code_page]
[392]ctfmon.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002D01F8 [unknown_code_page]
[392]ctfmon.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002D0A08 [unknown_code_page]
[392]ctfmon.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002D03FC [unknown_code_page]
[616]smss.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[664]csrss.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[664]csrss.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[688]winlogon.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[688]winlogon.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[688]winlogon.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[688]winlogon.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[688]winlogon.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000701F8 [unknown_code_page]
[688]winlogon.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000703FC [unknown_code_page]
[688]winlogon.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[688]winlogon.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[688]winlogon.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[688]winlogon.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[688]winlogon.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[732]services.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[732]services.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[732]services.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[732]services.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[732]services.exe-->advapi32.dll-->CreateProcessAsUserW, Type: IAT modification 0x01001094-->005E0002 [unknown_code_page]
[732]services.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[732]services.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[732]services.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[732]services.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[732]services.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[732]services.exe-->kernel32.dll-->CreateProcessW, Type: IAT modification 0x01001114-->005E0000 [unknown_code_page]
[732]services.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[732]services.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[732]services.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[732]services.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[732]services.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[732]services.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[732]services.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[732]services.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[752]lsass.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[752]lsass.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[752]lsass.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[752]lsass.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[752]lsass.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[752]lsass.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[752]lsass.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[752]lsass.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[752]lsass.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[752]lsass.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[912]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[912]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[912]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[912]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[912]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[912]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[912]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[912]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[912]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[912]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->ChangeServiceConfig2A, Type: Inline - RelativeJump 0x77E37101-->002B0C0C [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->ChangeServiceConfig2W, Type: Inline - RelativeJump 0x77E37189-->002B0E10 [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->ChangeServiceConfigA, Type: Inline - RelativeJump 0x77E36E69-->002B0804 [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->ChangeServiceConfigW, Type: Inline - RelativeJump 0x77E37001-->002B0A08 [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->CreateServiceA, Type: Inline - RelativeJump 0x77E37211-->002B01F8 [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->CreateServiceW, Type: Inline - RelativeJump 0x77E373A9-->002B03FC [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->DeleteService, Type: Inline - RelativeJump 0x77E374B1-->002B0600 [unknown_code_page]
[972]svchost.exe-->advapi32.dll-->SetServiceObjectSecurity, Type: Inline - RelativeJump 0x77E36D81-->002B1014 [unknown_code_page]
[972]svchost.exe-->kernel32.dll+0x00068D8C, Type: Code Mismatch 0x7C868D8C + 429452 [62]
[972]svchost.exe-->ntdll.dll+0x00016865, Type: Code Mismatch 0x7C916865 + 92261 [62]
[972]svchost.exe-->ntdll.dll-->LdrLoadDll, Type: Inline - RelativeJump 0x7C91632D-->000901F8 [unknown_code_page]
[972]svchost.exe-->ntdll.dll-->LdrUnloadDll, Type: Inline - RelativeJump 0x7C9171CD-->000903FC [unknown_code_page]
[972]svchost.exe-->user32.dll-->SetWindowsHookExA, Type: Inline - RelativeJump 0x7E431211-->002C0600 [unknown_code_page]
[972]svchost.exe-->user32.dll-->SetWindowsHookExW, Type: Inline - RelativeJump 0x7E42820F-->002C0804 [unknown_code_page]
[972]svchost.exe-->user32.dll-->SetWinEventHook, Type: Inline - RelativeJump 0x7E4317F7-->002C01F8 [unknown_code_page]
[972]svchost.exe-->user32.dll-->UnhookWindowsHookEx, Type: Inline - RelativeJump 0x7E42D5F3-->002C0A08 [unknown_code_page]
[972]svchost.exe-->user32.dll-->UnhookWinEvent, Type: Inline - RelativeJump 0x7E4318AC-->002C03FC [unknown_code_page]


OTL Script (01282012_124814):

All processes killed
========== PROCESSES ==========
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9D425283-D487-4337-BAB6-AB8354A81457}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{9D425283-D487-4337-BAB6-AB8354A81457} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{9D425283-D487-4337-BAB6-AB8354A81457}\ not found.
Registry value HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{EF99BD32-C1FB-11D2-892F-0090271D4F88} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{EF99BD32-C1FB-11D2-892F-0090271D4F88}\ deleted successfully.
========== REGISTRY ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus\\"DisableMonitoring" | 0 /E : value set successfully!
========== COMMANDS ==========

[EMPTYTEMP]

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes

User: drivers

User: i386

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Mom
->Temp folder emptied: 14138719 bytes
->Temporary Internet Files folder emptied: 41344181 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56218 bytes
->Flash cache emptied: 968 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Owner

User: Pete
->Temp folder emptied: 14458941 bytes
->Temporary Internet Files folder emptied: 227047926 bytes
->Java cache emptied: 3965102 bytes
->FireFox cache emptied: 108964531 bytes
->Flash cache emptied: 3141432 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 709456 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 79142023 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 242535101 bytes
%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 64235218 bytes

Total Files Cleaned = 763.00 mb


[EMPTYFLASH]

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: drivers

User: i386

User: LocalService

User: Mom
->Flash cache emptied: 0 bytes

User: NetworkService

User: Owner

User: Pete
->Flash cache emptied: 0 bytes

Total Flash Files Cleaned = 0.00 mb


[EMPTYJAVA]

User: All Users

User: Default User

User: drivers

User: i386

User: LocalService

User: Mom
->Java cache emptied: 0 bytes

User: NetworkService

User: Owner

User: Pete
->Java cache emptied: 0 bytes

Total Java Files Cleaned = 0.00 mb

C:\WINDOWS\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully

OTL by OldTimer - Version 3.2.31.0 log created on 01282012_124814

Files\Folders moved on Reboot...
File\Folder C:\Documents and Settings\Pete\Local Settings\Temp\~DFDABF.tmp not found!
File\Folder C:\Documents and Settings\Pete\Local Settings\Temporary Internet Files\Content.IE5\2Y90F3VV\b[1].gif not found!

Registry entries deleted on Reboot...


Also,

"deltalima" wrote:
253.98 Mb Total Physical Memory


That is a cause of the computer running slowly, XP needs at least twice that to function and realically needs 1 GB to perform as it should.
You need to increase the amount ot RAM.


I understand. I asked my brother for some extra memory for my PC for Christmas since he has a New Egg account, but he ended up getting me a type that was incompatible with my particular model of Dell (why wouldn't he just ask me what model I had?!?), but the replacement memory is on it's way.
deltalima
January 28, 2012, 8:28 PM UTC
Hi xyonist,

Let's try GMER again but with a different set of options.

  • Double click the GMER .exe file. If asked to allow gmer.sys driver to load, please consent
  • If it gives you a warning about rootkit activity and asks if you want to run scan...click on NO
  • In the right panel, you will see several boxes that have been checked. Uncheck the following ...
    • IAT/EAT
    • Drives/Partition other than Systemdrive (typically C:\)
    • Show All << (don't miss this one)

    See image below, Click the image to enlarge it


  • Then click the Scan button & wait for it to finish
  • Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file
  • Save it where you can easily find it, such as your desktop, and post it in your next reply
**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<--- ROOKIT" entries
Note: Do not run any programs while Gmer is running.
xyonist
January 30, 2012, 8:51 PM UTC
Hi Deltalima,

I was able to run GMER successfully (finally) overnight, but your message board says "Your message contains 107554 characters. The maximum number of allowed characters is 100000.", so I've included the log text as an attachment.

Attachments:

deltalima
January 30, 2012, 9:28 PM UTC
Hi xyonist,

Run Combofix

Temporarily disable any antispyware, antivirus and or antimalware real-time protection as they may interfere with running of ComboFix.

Download ComboFix from here to your Desktop.

For more information about Combofix please see here.

Close all programs.

Double click combofix.exe and follow the prompts.

If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it’s malware removal procedures, if not, then follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Once installed, you should see the following message:

The recovery console was successfuly installed.
Click ‘YES’ to continue scanning for malware
Click ‘NO’ for exit

Click the YES button.

The scan will temporarily disable your desktop, and if interrupted may leave your desktop disabled. If this occurs, please reboot to restore the desktop. Even when ComboFix appears to be doing nothing, look at your drive access light. If it is flashing, Combofix is still at work.

When finished ComboFix will produce a log file. Please post the contents of this log in your next reply.
xyonist
February 1, 2012, 8:17 PM UTC
Hello again Deltalima,

I have successfully run Combofix. Here is the log:

ComboFix 12-01-31.01 - Pete 02/01/2012 2:34.1.1 - x86
Running from: c:\documents and settings\[removed]\Desktop\ComboFix.exe
AV: avast! Antivirus *Disabled/Updated* {7591DB91-41F0-48A3-B128-1A293FD8233D}
AV: Trend Micro PC-cillin Internet Security *Disabled/Outdated* {7D2296BC-32CC-4519-917E-52E652474AF5}
.
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\documents and settings\All Users\Application Data\TEMP
c:\documents and settings\drivers\System
c:\documents and settings\drivers\System\865.cat
c:\documents and settings\drivers\System\865.inf
c:\documents and settings\drivers\System\865.PNF
c:\documents and settings\drivers\System\915.cat
c:\documents and settings\drivers\System\915.inf
c:\documents and settings\drivers\System\915.PNF
c:\documents and settings\drivers\System\915M.cat
c:\documents and settings\drivers\System\915M.inf
c:\documents and settings\drivers\System\915M.PNF
c:\documents and settings\drivers\System\945.cat
c:\documents and settings\drivers\System\945.inf
c:\documents and settings\drivers\System\945.PNF
c:\documents and settings\drivers\System\dmi_pci.cat
c:\documents and settings\drivers\System\dmi_pci.inf
c:\documents and settings\drivers\System\dmi_pci.PNF
c:\documents and settings\drivers\System\E7220.cat
c:\documents and settings\drivers\System\E7220.inf
c:\documents and settings\drivers\System\E7220.PNF
c:\documents and settings\drivers\System\E7520.cat
c:\documents and settings\drivers\System\E7520.inf
c:\documents and settings\drivers\System\E7520.PNF
c:\documents and settings\drivers\System\E8500.cat
c:\documents and settings\drivers\System\E8500.inf
c:\documents and settings\drivers\System\E8500.PNF
c:\documents and settings\drivers\System\ich5core.cat
c:\documents and settings\drivers\System\ich5core.inf
c:\documents and settings\drivers\System\ich5core.PNF
c:\documents and settings\drivers\System\ich5ide.cat
c:\documents and settings\drivers\System\ich5ide.inf
c:\documents and settings\drivers\System\ich5ide.PNF
c:\documents and settings\drivers\System\ich5usb.cat
c:\documents and settings\drivers\System\ich5usb.inf
c:\documents and settings\drivers\System\ich5usb.PNF
c:\documents and settings\drivers\System\ich6core.cat
c:\documents and settings\drivers\System\ich6core.inf
c:\documents and settings\drivers\System\ich6core.PNF
c:\documents and settings\drivers\System\ich6ide.cat
c:\documents and settings\drivers\System\ich6ide.inf
c:\documents and settings\drivers\System\ich6ide.PNF
c:\documents and settings\drivers\System\ich6usb.cat
c:\documents and settings\drivers\System\ich6usb.inf
c:\documents and settings\drivers\System\ich6usb.PNF
c:\documents and settings\drivers\System\ich7core.cat
c:\documents and settings\drivers\System\ich7core.inf
c:\documents and settings\drivers\System\ich7core.PNF
c:\documents and settings\drivers\System\ich7ide.cat
c:\documents and settings\drivers\System\ich7ide.inf
c:\documents and settings\drivers\System\ich7ide.PNF
c:\documents and settings\drivers\System\ich7usb.cat
c:\documents and settings\drivers\System\ich7usb.inf
c:\documents and settings\drivers\System\ich7usb.PNF
c:\documents and settings\drivers\System\INFAnswr.txt
c:\documents and settings\drivers\System\INFCACHE.1
c:\documents and settings\drivers\System\SP\ich5id2.cat
c:\documents and settings\drivers\System\SP\ich5id2.inf
c:\documents and settings\drivers\System\SP\ich5id2.PNF
c:\documents and settings\drivers\System\SP\ich6id2.cat
c:\documents and settings\drivers\System\SP\ich6id2.inf
c:\documents and settings\drivers\System\SP\ich6id2.PNF
c:\documents and settings\drivers\System\SP\ich7id2.cat
c:\documents and settings\drivers\System\SP\ich7id2.inf
c:\documents and settings\drivers\System\SP\ich7id2.PNF
c:\documents and settings\drivers\System\SP\INFCACHE.1
c:\documents and settings\i386\1033.MST
c:\documents and settings\i386\1394.inf
c:\documents and settings\i386\accwiz.exe
c:\documents and settings\i386\actmovie.exe
c:\documents and settings\i386\advapi32.dll
c:\documents and settings\i386\afd.sys
c:\documents and settings\i386\ahui.exe
c:\documents and settings\i386\alg.exe
c:\documents and settings\i386\append.exe
c:\documents and settings\i386\arp.exe
c:\documents and settings\i386\at.exe
c:\documents and settings\i386\atmadm.exe
c:\documents and settings\i386\auditusr.exe
c:\documents and settings\i386\autochk.exe
c:\documents and settings\i386\autoconv.exe
c:\documents and settings\i386\autofmt.exe
c:\documents and settings\i386\autolfn.exe
c:\documents and settings\i386\blastcln.exe
c:\documents and settings\i386\bootok.exe
c:\documents and settings\i386\bootvrfy.exe
c:\documents and settings\i386\cacls.exe
c:\documents and settings\i386\calc.exe
c:\documents and settings\i386\charmap.exe
c:\documents and settings\i386\chkdsk.exe
c:\documents and settings\i386\chkntfs.exe
c:\documents and settings\i386\cidaemon.exe
c:\documents and settings\i386\cisvc.exe
c:\documents and settings\i386\ckcnv.exe
c:\documents and settings\i386\cleanmgr.exe
c:\documents and settings\i386\cliconfg.exe
c:\documents and settings\i386\clipbrd.exe
c:\documents and settings\i386\clipsrv.exe
c:\documents and settings\i386\cmmon32.exe
c:\documents and settings\i386\COMPLINC.DLL
c:\documents and settings\i386\CONFIG.TMP
c:\documents and settings\i386\conime.exe
c:\documents and settings\i386\control.exe
c:\documents and settings\i386\csrss.exe
c:\documents and settings\i386\ctfmon.exe
c:\documents and settings\i386\dcomcnfg.exe
c:\documents and settings\i386\ddeshare.exe
c:\documents and settings\i386\debug.exe
c:\documents and settings\i386\defrag.exe
c:\documents and settings\i386\dfrgfat.exe
c:\documents and settings\i386\dfrgntfs.exe
c:\documents and settings\i386\diskpart.exe
c:\documents and settings\i386\diskperf.exe
c:\documents and settings\i386\dmadmin.exe
c:\documents and settings\i386\dmremote.exe
c:\documents and settings\i386\doskey.exe
c:\documents and settings\i386\dosx.exe
c:\documents and settings\i386\dplaysvr.exe
c:\documents and settings\i386\dpnsvr.exe
c:\documents and settings\i386\dpvsetup.exe
c:\documents and settings\i386\drwatson.exe
c:\documents and settings\i386\drwtsn32.exe
c:\documents and settings\i386\dumprep.exe
c:\documents and settings\i386\dvdplay.exe
c:\documents and settings\i386\dvdupgrd.exe
c:\documents and settings\i386\dwwin.exe
c:\documents and settings\i386\dxdiag.exe
c:\documents and settings\i386\e100bmsg.dll
c:\documents and settings\i386\edlin.exe
c:\documents and settings\i386\esentutl.exe
c:\documents and settings\i386\eudcedit.exe
c:\documents and settings\i386\EULA.txt
c:\documents and settings\i386\eventvwr.exe
c:\documents and settings\i386\expand.exe
c:\documents and settings\i386\extrac32.exe
c:\documents and settings\i386\fastopen.exe
c:\documents and settings\i386\fixmapi.exe
c:\documents and settings\i386\fontview.exe
c:\documents and settings\i386\forcedos.exe
c:\documents and settings\i386\freecell.exe
c:\documents and settings\i386\fxsst.dll
c:\documents and settings\i386\help.exe
c:\documents and settings\i386\hostname.exe
c:\documents and settings\i386\hosts
c:\documents and settings\i386\HWDB.DLL
c:\documents and settings\i386\Internet Explorer.lnk
c:\documents and settings\i386\java.exe
c:\documents and settings\i386\javaw.exe
c:\documents and settings\i386\jgaw400.dll
c:\documents and settings\i386\kernel32.dll
c:\documents and settings\i386\krnl386.exe
c:\documents and settings\i386\LEARN32.DLL
c:\documents and settings\i386\linkinfo.dll
c:\documents and settings\i386\locator.exe
c:\documents and settings\i386\logagent.exe
c:\documents and settings\i386\logman.exe
c:\documents and settings\i386\logoff.exe
c:\documents and settings\i386\logonui.exe
c:\documents and settings\i386\lsass.exe
c:\documents and settings\i386\mmc.exe
c:\documents and settings\i386\mscorwks.dll
c:\documents and settings\i386\mshearts.exe
c:\documents and settings\i386\mshta.exe
c:\documents and settings\i386\mspaint.exe
c:\documents and settings\i386\narrator.exe
c:\documents and settings\i386\net.exe
c:\documents and settings\i386\net1.exe
c:\documents and settings\i386\netdde.exe
c:\documents and settings\i386\netsh.exe
c:\documents and settings\i386\netstat.exe
c:\documents and settings\i386\nlsfunc.exe
c:\documents and settings\i386\notepad.exe
c:\documents and settings\i386\nslookup.exe
c:\documents and settings\i386\ntkrnlpa.exe
c:\documents and settings\i386\ntoskrnl.exe
c:\documents and settings\i386\ntsd.exe
c:\documents and settings\i386\ntvdm.exe
c:\documents and settings\i386\odbcad32.exe
c:\documents and settings\i386\odbcconf.exe
c:\documents and settings\i386\osk.exe
c:\documents and settings\i386\perfmon.exe
c:\documents and settings\i386\ping.exe
c:\documents and settings\i386\ping6.exe
c:\documents and settings\i386\powercfg.exe
c:\documents and settings\i386\print.exe
c:\documents and settings\i386\progman.exe
c:\documents and settings\i386\proquota.exe
c:\documents and settings\i386\proxycfg.exe
c:\documents and settings\i386\QuickTime.cpl
c:\documents and settings\i386\QuickTime.qts
c:\documents and settings\i386\QuickTimeAuthoring.qtx
c:\documents and settings\i386\QuickTimeCapture.qtx
c:\documents and settings\i386\QuickTimeCheck.ocx
c:\documents and settings\i386\QuickTimeEssentials.qtx
c:\documents and settings\i386\QuickTimeImage.qtx
c:\documents and settings\i386\QuickTimeInternetExtras.qtx
c:\documents and settings\i386\QuickTimeMPEG.qtx
c:\documents and settings\i386\QuickTimePlayerExtras.qpx
c:\documents and settings\i386\QuickTimeStreaming.qtx
c:\documents and settings\i386\QuickTimeVR.qtx
c:\documents and settings\i386\QuickTimeWebHelper.qtx
c:\documents and settings\i386\qwinsta.exe
c:\documents and settings\i386\rasautou.exe
c:\documents and settings\i386\rasdial.exe
c:\documents and settings\i386\rasphone.exe
c:\documents and settings\i386\rdpclip.exe
c:\documents and settings\i386\rdsaddin.exe
c:\documents and settings\i386\rdshost.exe
c:\documents and settings\i386\regedit.exe
c:\documents and settings\i386\regedt32.exe
c:\documents and settings\i386\regini.exe
c:\documents and settings\i386\regsvr32.exe
c:\documents and settings\i386\route.exe
c:\documents and settings\i386\routemon.exe
c:\documents and settings\i386\rundll32.exe
c:\documents and settings\i386\runonce.exe
c:\documents and settings\i386\rwinsta.exe
c:\documents and settings\i386\savedump.exe
c:\documents and settings\i386\scardsvr.exe
c:\documents and settings\i386\secdrv.sys
c:\documents and settings\i386\services.exe
c:\documents and settings\i386\sessmgr.exe
c:\documents and settings\i386\smss.exe
c:\documents and settings\i386\sndrec32.exe
c:\documents and settings\i386\sndvol32.exe
c:\documents and settings\i386\sol.exe
c:\documents and settings\i386\spider.exe
c:\documents and settings\i386\spnpinst.exe
c:\documents and settings\i386\spoolsv.exe
c:\documents and settings\i386\svchost.exe
c:\documents and settings\i386\sysedit.exe
c:\documents and settings\i386\syskey.exe
c:\documents and settings\i386\sysocmgr.exe
c:\documents and settings\i386\TASKMAN.EXE
c:\documents and settings\i386\Taskmgr.exe
c:\documents and settings\i386\tourstart.exe
c:\documents and settings\i386\user.exe
c:\documents and settings\i386\userinit.exe
c:\documents and settings\i386\usersid.exe
c:\documents and settings\i386\usp10.dll
c:\documents and settings\i386\utilman.exe
c:\documents and settings\i386\verifier.exe
c:\documents and settings\i386\vssadmin.exe
c:\documents and settings\i386\vssvc.exe
c:\documents and settings\i386\winhlp32.exe
c:\documents and settings\i386\winlogon.exe
c:\documents and settings\i386\winmine.exe
c:\documents and settings\i386\winmsd.exe
c:\documents and settings\i386\winspool.exe
c:\documents and settings\i386\winver.exe
c:\documents and settings\i386\wowdeb.exe
c:\documents and settings\i386\wowexec.exe
c:\documents and settings\i386\wpabaln.exe
c:\documents and settings\i386\wpnpinst.exe
c:\documents and settings\i386\write.exe
c:\documents and settings\i386\wscntfy.exe
c:\documents and settings\i386\wuauclt.exe
c:\documents and settings\i386\wuauclt1.exe
c:\documents and settings\i386\wupdmgr.exe
c:\documents and settings\i386\xcopy.exe
c:\documents and settings\Pete\WINDOWS
c:\windows\explorer(2).exe
.
.
((((((((((((((((((((((((( Files Created from 2012-01-01 to 2012-02-01 )))))))))))))))))))))))))))))))
.
.
2012-01-28 19:46 . 2012-01-28 19:46 -------- d-----w- c:\program files\Common Files\Java
2012-01-28 19:45 . 2012-01-28 19:43 73728 ----a-w- c:\windows\system32\javacpl.cpl
2012-01-28 18:49 . 2012-01-28 18:49 -------- d-----w- c:\program files\Common Files\Adobe AIR
2012-01-28 17:48 . 2012-01-28 17:48 -------- d-----w- C:\_OTL
2012-01-26 19:10 . 2012-01-26 19:15 -------- d-----w- C:\b5405763cbcb5da0e20097b71f12
2012-01-26 18:52 . 2012-01-26 18:52 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\Intuit
2012-01-26 18:35 . 2012-01-26 18:35 -------- d-----w- c:\documents and settings\Pete\Local Settings\Application Data\IsolatedStorage
2012-01-26 18:34 . 2012-01-26 18:51 -------- d-----w- c:\program files\Common Files\Intuit
2012-01-26 18:33 . 2012-01-26 18:33 -------- d-----w- c:\program files\TurboTax
2012-01-26 06:43 . 2012-01-26 06:44 -------- d-----w- C:\e919ddc6f515ef7dbeed
2012-01-26 06:25 . 2012-01-26 18:52 -------- d-----w- c:\documents and settings\All Users\Application Data\Intuit
2012-01-24 17:17 . 2011-11-28 17:51 20568 ----a-w- c:\windows\system32\drivers\aswFsBlk.sys
2012-01-24 17:17 . 2011-11-28 17:53 314456 ----a-w- c:\windows\system32\drivers\aswSP.sys
2012-01-24 17:17 . 2011-11-28 17:52 34392 ----a-w- c:\windows\system32\drivers\aswRdr.sys
2012-01-24 17:17 . 2011-11-28 17:52 52952 ----a-w- c:\windows\system32\drivers\aswTdi.sys
2012-01-24 17:17 . 2011-11-28 17:53 435032 ----a-w- c:\windows\system32\drivers\aswSnx.sys
2012-01-24 17:16 . 2011-11-28 17:52 111320 ----a-w- c:\windows\system32\drivers\aswmon2.sys
2012-01-24 17:16 . 2011-11-28 17:51 105176 ----a-w- c:\windows\system32\drivers\aswmon.sys
2012-01-24 17:16 . 2011-11-28 17:48 30808 ----a-w- c:\windows\system32\drivers\aavmker4.sys
2012-01-24 17:15 . 2011-11-28 18:01 41184 ----a-w- c:\windows\avastSS.scr
2012-01-24 17:15 . 2011-11-28 18:01 199816 ----a-w- c:\windows\system32\aswBoot.exe
2012-01-24 17:14 . 2012-01-24 17:14 -------- d-----w- c:\program files\AVAST Software
2012-01-24 17:14 . 2012-01-24 17:14 -------- d-----w- c:\documents and settings\All Users\Application Data\AVAST Software
2012-01-11 02:04 . 2012-01-11 02:04 -------- d-----w- c:\program files\Defraggler
2012-01-11 01:40 . 2012-01-11 01:40 -------- d-----w- c:\program files\CCleaner
2012-01-11 01:16 . 2012-01-11 01:16 -------- d-----w- c:\documents and settings\Pete\Application Data\WinPatrol
2012-01-11 01:15 . 2012-01-11 01:15 -------- d-----w- c:\program files\BillP Studios
2012-01-11 01:15 . 2012-01-11 01:15 -------- d-----w- c:\documents and settings\All Users\Application Data\InstallMate
2012-01-03 13:10 . 2012-01-03 13:10 182672 ----a-w- c:\program files\Mozilla Firefox\plugins\nppdf32.dll
2012-01-03 13:10 . 2012-01-03 13:10 182672 ----a-w- c:\program files\Internet Explorer\PLUGINS\nppdf32.dll
.
.
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-28 19:43 . 2011-01-03 01:40 472808 ----a-w- c:\windows\system32\deployJava1.dll
2011-12-29 14:23 . 2011-08-11 19:09 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2011-12-26 01:23 . 2011-11-15 19:05 260 ----a-w- c:\windows\system32\cmdVBS.vbs
2011-12-26 01:23 . 2011-11-15 19:05 256 ----a-w- c:\windows\system32\MSIevent.bat
2011-11-25 21:57 . 2004-08-10 18:51 293376 ----a-w- c:\windows\system32\winsrv.dll
2011-11-23 13:25 . 2004-08-10 18:51 1859584 ----a-w- c:\windows\system32\win32k.sys
2011-11-18 12:35 . 2004-08-10 18:51 60416 ----a-w- c:\windows\system32\packager.exe
2011-11-16 14:21 . 2004-08-10 18:51 354816 ----a-w- c:\windows\system32\winhttp.dll
2011-11-16 14:21 . 2004-08-10 18:51 152064 ----a-w- c:\windows\system32\schannel.dll
2011-11-04 19:20 . 2004-08-10 18:51 916992 ----a-w- c:\windows\system32\wininet.dll
2011-11-04 19:20 . 2004-08-10 18:51 43520 ----a-w- c:\windows\system32\licmgr10.dll
2011-11-04 19:20 . 2004-08-10 18:51 1469440 ------w- c:\windows\system32\inetcpl.cpl
2011-11-04 11:23 . 2004-08-10 18:51 385024 ----a-w- c:\windows\system32\html.iec
2011-11-03 15:28 . 2004-08-10 18:51 386048 ----a-w- c:\windows\system32\qdvd.dll
2011-11-03 15:28 . 2004-08-10 18:51 1292288 ----a-w- c:\windows\system32\quartz.dll
2009-09-14 02:10 . 2009-10-15 23:23 47104 ----a-w- c:\program files\mozilla firefox\components\FFComm.dll
.
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\00avast]
@="{472083B0-C522-11CF-8763-00608CC02F24}"
[HKEY_CLASSES_ROOT\CLSID\{472083B0-C522-11CF-8763-00608CC02F24}]
2011-11-28 18:01 122512 ----a-w- c:\program files\AVAST Software\Avast\ashShell.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"igfxtray"="c:\windows\system32\igfxtray.exe" [2005-09-20 94208]
"igfxpers"="c:\windows\system32\igfxpers.exe" [2005-09-20 114688]
"igfxhkcmd"="c:\windows\system32\hkcmd.exe" [2005-09-20 77824]
"HPHUPD05"="c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe" [2003-08-20 49152]
"HP Component Manager"="c:\program files\HP\hpcoretech\hpcmpmgr.exe" [2003-08-20 221184]
"HP Software Update"="c:\program files\Hewlett-Packard\HP Software Update\HPWuSchd.exe" [2003-06-25 49152]
"HPHmon05"="c:\windows\system32\hphmon05.exe" [2003-08-20 483328]
"Verizon_McciTrayApp"="c:\program files\Verizon\McciTrayApp.exe" [2010-03-17 1565696]
"SoundMAXPnP"="c:\program files\Analog Devices\Core\smax4pnp.exe" [2004-10-15 1404928]
"Malwarebytes Anti-Malware (reboot)"="c:\program files\Malwarebytes' Anti-Malware\mbam.exe" [2011-08-31 1047208]
"HPDJ Taskbar Utility"="c:\windows\system32\spool\drivers\w32x86\3\hpztsb09.exe" [2003-07-25 188416]
"APSDaemon"="c:\program files\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2011-10-24 421888]
"avast"="c:\program files\AVAST Software\Avast\avastUI.exe" [2011-11-28 3744552]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
.
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{56F9679E-7826-4C84-81F3-532071A8BCC5}"= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute REG_MULTI_SZ autocheck autochk *\0SsiEfr.e
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
backup=c:\windows\pss\Digital Line Detect.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Search.lnk]
path=c:\documents and settings\All Users\Start Menu\Programs\Startup\Windows Search.lnk
backup=c:\windows\pss\Windows Search.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DMXLauncher]
2005-01-27 07:02 86016 -c--a-w- c:\program files\Dell\Media Experience\DMXLauncher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
2008-04-14 00:12 1695232 ----a-w- c:\program files\Messenger\msmsgs.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"WinDefend"=2 (0x2)
"VSSERV"=2 (0x2)
"PcCtlCom"=2 (0x2)
"McAfee SiteAdvisor Service"=2 (0x2)
"LIVESRV"=2 (0x2)
"iPod Service"=3 (0x3)
"gupdate1c9f747ee1c2390"=2 (0x2)
"GameConsoleService"=3 (0x3)
"Arrakis3"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"acssrv"=2 (0x2)
"Bonjour Service"=2 (0x2)
"gupdate"=2 (0x2)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\TrendAntiVirus]
"DisableMonitoring"="0"
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\Infogrames Interactive\\Monopoly Tycoon\\mc.exe"=
"c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
"c:\\Program Files\\Verizon\\Verizon Media Manager\\Release\\Verizon Media Manager.exe"=
"c:\\Program Files\\Verizon\\Verizon Media Manager\\Release\\VZVideoAgent.exe"=
"c:\\Documents and Settings\\Pete\\Application Data\\Spotify\\spotify.exe"=
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"67:UDP"= 67:UDP:DHCP Discovery Service
"50000:UDP"= 50000:UDP:IHA_MessageCenter
.
R3 BlackBox;BlackBox SR2; [x]
S1 aswSnx;aswSnx; [x]
S1 aswSP;aswSP; [x]
S2 aswFsBlk;aswFsBlk; [x]
S2 IHA_MessageCenter;IHA_MessageCenter;c:\program files\Verizon\IHA_MessageCenter\Bin\Verizon_IHAMessageCenter.exe [2011-12-12 290832]
.
.
Contents of the 'Scheduled Tasks' folder
.
2012-01-04 c:\windows\Tasks\HP DArC Task 2003-08-20 09:23ewlett-Packard-6002003-08-20 19:57Y3B6320MYK3.job
- c:\program files\HP\hpcoretech\comp\hpdarc.exe [2003-08-20 19:57]
.
2012-01-31 c:\windows\Tasks\HP Usg Daily.job
- c:\program files\Hewlett-Packard\{45B6180B-DCAB-4093-8EE8-6164457517F0}\pexpress\hphped05.exe [2011-01-07 21:23]
.
2012-01-31 c:\windows\Tasks\User_Feed_Synchronization-{E0E55684-B27B-4240-9149-5E6FED5E3F11}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 08:31]
.
.
------- Supplementary Scan -------
.
uStart Page = hxxp://www.yahoo.com/
uInternet Settings,ProxyOverride = 127.0.0.1
IE: &ieSpell Options - c:\program files\ieSpell\iespell.dll/SPELLOPTION.HTM
IE: Check &Spelling - c:\program files\ieSpell\iespell.dll/SPELLCHECK.HTM
TCP: DhcpNameServer = 192.168.1.1
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
FF - ProfilePath - c:\documents and settings\Pete\Application Data\Mozilla\Firefox\Profiles\b67i1qst.Pete\
FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com
FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\Mozilla Firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0011-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0016-ABCDEFFEDCBA}
FF - Ext: Java Console: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} - c:\program files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA}
FF - Ext: Smart Bookmarks Bar: [removed] - %profile%\extensions\[removed]
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}
FF - Ext: NoScript: {73a6fe31-595d-460b-a920-fcc0f8843232} - %profile%\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}
FF - Ext: Flagfox: {1018e4d6-728f-4b20-ad56-37578a4de76b} - %profile%\extensions\{1018e4d6-728f-4b20-ad56-37578a4de76b}
FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF - Ext: Java Quick Starter: [removed] - c:\program files\Java\jre6\lib\deploy\jqs\ff
FF - Ext: avast! WebRep: [removed] - c:\program files\AVAST Software\Avast\WebRep\FF
.
- - - - ORPHANS REMOVED - - - -
.
MSConfigStartUp-BDAgent - c:\program files\BitDefender\BitDefender 2010\bdagent.exe
MSConfigStartUp-BitDefender Antiphishing Helper - c:\program files\BitDefender\BitDefender 2010\IEShow.exe
MSConfigStartUp-ISUSPM Startup - c:\program files\Common Files\InstallShield\UpdateService\isuspm.exe
MSConfigStartUp-ISUSScheduler - c:\program files\Common Files\InstallShield\UpdateService\issch.exe
MSConfigStartUp-iTunesHelper - c:\program files\iTunes\iTunesHelper.exe
MSConfigStartUp-msnmsgr - c:\program files\Windows Live\Messenger\msnmsgr.exe
MSConfigStartUp-MySpaceIM - c:\program files\MySpace\IM\MySpaceIM.exe
MSConfigStartUp-OE_OEM - c:\program files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe
MSConfigStartUp-OutpostFeedBack - c:\program files\Agnitum\Outpost Firewall\feedback.exe
MSConfigStartUp-OutpostMonitor - c:\progra~1\Agnitum\OUTPOS~1\op_mon.exe
MSConfigStartUp-pccguide - c:\program files\Trend Micro\Internet Security 12\pccguide.exe
MSConfigStartUp-RealTray - c:\program files\Real\RealPlayer\RealPlay.exe
MSConfigStartUp-SpybotSD TeaTimer - c:\program files\Spybot - Search & Destroy\TeaTimer.exe
AddRemove-TurboTax 2011 - c:\program files\TurboTax\Basic 2011\Installer\TurboTax 2011 Installer.exe
AddRemove-WebCyberCoach_wtrb - c:\program files\WebCyberCoach\b_Dell\WCC_Wipe.exe WebCyberCoach ext\wtrb
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2012-02-01 03:27
Windows 5.1.2600 Service Pack 3 NTFS
.
scanning hidden processes ...
.
scanning hidden autostart entries ...
.
scanning hidden files ...
.
scan completed successfully
hidden files: 0
.
**************************************************************************
.
--------------------- LOCKED REGISTRY KEYS ---------------------
.
[HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
[HKEY_USERS\S-1-5-21-2648800068-1536023876-680085538-1006\Software\Policies\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (S-1-5-21-2648800068-1536023876-680085538-1006)
@Allowed: (Read) (S-1-5-21-2648800068-1536023876-680085538-1006)
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)
.
Completion time: 2012-02-01 03:51:41
ComboFix-quarantined-files.txt 2012-02-01 08:51
.
Pre-Run: 5,233,000,448 bytes free
Post-Run: 5,185,028,096 bytes free
.
- - End Of File - - A9D88851074487E604118704FF757FE6
deltalima
February 1, 2012, 8:25 PM UTC
Hi xyonist,

ESET Online Scanner:

Note: You can use either Internet Explorer or Mozilla FireFox for this scan. You will however need to disable your current installed Anti-Virus, how to do so can be read here.

Vista/Windows 7 users: You will need to to right-click on the either the IE or FF icon in the Start Menu or Quick Launch Bar on the Taskbar and select Run as Administrator from the context menu.

  • Please go here to run the scan.
    Note: If using Mozilla Firefox you will need to download esetsmartinstaller_enu.exe when prompted then double click on it to install.
    All of the below instructions are compatible with either Internet Explorer or Mozilla FireFox.
  • Select the option YES, I accept the Terms of Use then click on:
  • When prompted allow the Add-On/Active X to install.
  • Make sure that the option Remove found threats is NOT checked, and the option Scan archives is checked.
  • Now click on Advanced Settings and select the following:

    • Scan for potentially unwanted applications
    • Scan for potentially unsafe applications
    • Enable Anti-Stealth Technology

  • Now click on:
  • The virus signature database... will begin to download. Be patient this make take some time depending on the speed of your Internet Connection.
  • When completed the Online Scan will begin automatically.
  • Do not touch either the Mouse or keyboard during the scan otherwise it may stall.
  • When completed select Uninstall application on close if you so wish, make sure you copy the logfile first!
  • Now click on:
  • Use notepad to open the logfile located at C:\Program Files\ESET\EsetOnlineScanner\log.txt.
  • Copy and paste that log as a reply to this topic.


Note: Do not forget to re-enable your Anti-Virus application after running the above scan!

Please let me know how the computer is running now.
xyonist
February 2, 2012, 8:18 PM UTC
Hi Deltalima,

My computer is running much better than before. I do appreciate all of your help with this and I will certainly be making a donation (albeit a small one....sorry) to your site as a token of my appreciation.

I was able to run ESET Scanner successfully (twice, but I accidentally deleted the first log). Here is the log:

ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=85eae4af2591f045ad5f691de42481e6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-02-02 05:16:57
# local_time=2012-02-02 12:16:57 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777195 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=102449
# found=0
# cleaned=0
# scan_time=9511
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=85eae4af2591f045ad5f691de42481e6
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=true
# antistealth_checked=true
# utc_time=2012-02-02 12:53:43
# local_time=2012-02-02 07:53:43 (-0500, Eastern Standard Time)
# country="United States"
# lang=1033
# osver=5.1.2600 NT Service Pack 3
# compatibility_mode=512 16777195 100 0 0 0 0 0
# compatibility_mode=8192 67108863 100 0 0 0 0 0
# scanned=103371
# found=0
# cleaned=0
# scan_time=9858
deltalima
February 2, 2012, 8:20 PM UTC
Hi xyonist,

Now that you are clean, please follow these steps in order to keep your computer clean and secure.

Remove GMER

Delete the GMER icon from your desktop.

Uninstall ComboFix

  • Click START then RUN
  • Now type Combofix /Uninstall in the runbox and click OK


Clean up with OTL

  • Double-click OTL.exe to start the program. This will remove all the tools we used to clean your pc.
  • Close all other programs apart from OTL as this step will require a reboot
  • On the OTL main screen, press the CleanUp! button
  • Say Yes to the prompt and then allow the program to reboot your computer.


Create a new, clean System Restore point which you can use in case of future system problems:
  • Press Start >> All Programs >> Accessories >>System Tools >> System Restore
  • Select Create a restore point, then Next, type a name like All Clean then press the Create button and once it's done press Close
  • Now remove old, infected System Restore points:
  • Next click Start >> Run and type cleanmgr in the box and press OK
  • Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
  • Select the More Options tab, under System Restore press Clean up... and say Yes to the prompt
  • Press OK and Yes to confirm


Update your AntiVirus Software and keep your other programs up-to-date
Update your Antivirus programs and other security products regularly to avoid new threats that could infect your system.
You can use one of these sites to check if any updates are needed for your pc.
Secunia Software Inspector
F-secure Health Check

Security Updates for Windows, Internet Explorer & Microsoft Office
Whenever a security problem in its software is found, Microsoft will usually create a patch so that after the patch is installed, attackers can't use the vulnerability to install malicious software on your PC. Keeping up with these patches will help to prevent malicious software being installed on your PC. Ensure you are registered for Windows updates via Start > right-click on My Computer > Properties > Automatic Updates tab or visit the Microsoft Update site on a regular basis.

Happy surfing and stay clean!
deltalima
February 3, 2012, 1:38 PM UTC
As your problems appear to have been resolved,