1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved XP has a virus

Discussion in 'Malware and Virus Removal Archive' started by sallnjackn, 2011/12/17.

Page 1 of 2
  1. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    [Resolved] XP has a virus

    Thread started here ....

    http://www.windowsbbs.com/windows-xp/101284-xp-has-virus.html

    Malwarebytes' Anti-Malware 1.51.2.1300
    www.malwarebytes.org

    Database version: 8390

    Windows 5.1.2600 Service Pack 3
    Internet Explorer 8.0.6001.18702

    12/17/2011 8:16:20 PM
    mbam-log-2011-12-17 (20-16-20).txt

    Scan type: Quick scan
    Objects scanned: 248705
    Time elapsed: 23 minute(s), 38 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 0

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    (No malicious items detected)
     
    sallnjackn,
    #1
  2. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    GMER 1.0.15.15641 - http://www.gmer.net
    Rootkit scan 2011-12-17 21:24:28
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdePort0 WDC_WD5000AAKB-00H8A0 rev.05.04E05
    Running: x9h796rv.exe; Driver: C:\DOCUME~1\Sallie\LOCALS~1\Temp\awldrfob.sys


    ---- System - GMER 1.0.15 ----

    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xEBBB8534]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xEBBB2782]
    SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwCreateKey [0xF7474290]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xEBBB8CC0]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcess [0xEBBCBEB4]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateProcessEx [0xEBBCC2A2]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateSection [0xEBBD5916]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xEBBB8DF6]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xEBBB3398]
    SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteKey [0xF7474500]
    SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwDeleteValueKey [0xF74745C0]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDuplicateObject [0xEBBCADF0]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xEBBD393C]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xEBBD3B44]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xEBBB2FAA]
    SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwOpenKey [0xF7474130]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenProcess [0xEBBCE1CE]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenThread [0xEBBCDDF8]
    SSDT PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwRenameKey [0xF7648E16]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xEBBD4208]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xEBBB80F4]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xEBBD52A4]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSecureConnectPort [0xEBBB87DC]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xEBBB375C]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xEBBD4E12]
    SSDT TfSysMon.sys (ThreatFire System Monitor/PC Tools) ZwSetValueKey [0xF74747C0]
    SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSystemDebugControl [0xEBBCCF0A]
    SSDT \??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xEBABD640]

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntoskrnl.exe!_abnormal_termination + 104 804E2770 12 Bytes [C0, 8C, BB, EB, B4, BE, BC, ...]
    .text ntoskrnl.exe!_abnormal_termination + 34C 804E29B8 2 Bytes [16, 8E]
    .text ntoskrnl.exe!_abnormal_termination + 34F 804E29BB 5 Bytes [F7, 08, 42, BD, EB]
    .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF37C93A0, 0x8A1A15, 0xE8000020]

    ---- User code sections - GMER 1.0.15 ----

    .text C:\WINDOWS\System32\svchost.exe[192] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A40001
    .text C:\WINDOWS\System32\svchost.exe[192] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files
     
    sallnjackn,
    #2


  3. to hide this advert.

  4. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    \CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[192] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Bonjour\mDNSResponder.exe[556] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[580] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[580] USER32.dll!DefDlgProcW + 56E 7E4242A8 5 Bytes JMP 20C79270 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\spoolsv.exe[652] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\winlogon.exe[848] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\services.exe[900] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\lsass.exe[920] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A90001
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\msworks calendar\WKCALREM.EXE[948] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\wuauclt.exe[1064] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1108] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtLoadDriver 7C90D46E 3 Bytes [FF, 25, 1E]
    .text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtLoadDriver + 4 7C90D472 2 Bytes [58, 71]
    .text C:\WINDOWS\System32\svchost.exe[1284] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!DeviceIoControl 7C801629 6 Bytes JMP 70DB000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateFileA 7C801A28 6 Bytes JMP 7114000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!VirtualProtectEx 7C801A61 6 Bytes JMP 715C000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!VirtualProtect 7C801AD4 6 Bytes JMP 7108000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A20001
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!VirtualAlloc 7C809AF1 6 Bytes JMP 710B000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!MultiByteToWideChar 7C809C98 6 Bytes JMP 70AD000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!LoadResource 7C80A055 6 Bytes JMP 70F6000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!WideCharToMultiByte 7C80A174 6 Bytes JMP 708C000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 714A000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateMutexW 7C80E957 6 Bytes JMP 70B6000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateMutexA 7C80E9DF 6 Bytes JMP 70B9000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!OpenMutexW
     
    sallnjackn,
    #3
  5. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    7C80EA35 6 Bytes JMP 70B0000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!OpenMutexA 7C80EABB 6 Bytes JMP 70B3000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!GetVolumeInformationW 7C80FA85 6 Bytes JMP 7144000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateThread 7C8106D7 6 Bytes JMP 710E000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateFileW 7C810800 6 Bytes JMP 7117000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!WriteFile 7C810E27 5 Bytes JMP 006C000C
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!MoveFileW 7C821261 6 Bytes JMP 7085000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateDirectoryA 7C8217AC 6 Bytes JMP 70D2000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!GetVolumeInformationA 7C821BA5 6 Bytes JMP 7147000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CopyFileExW 7C827B32 6 Bytes JMP 70EA000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CopyFileA 7C8286EE 6 Bytes JMP 70F3000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CopyFileW 7C82F87B 6 Bytes JMP 70F0000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!DeleteFileA 7C831EDD 6 Bytes JMP 709E000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!DeleteFileW 7C831F63 6 Bytes JMP 709B000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateDirectoryW 7C832402 6 Bytes JMP 70CF000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!MoveFileExW 7C83568B 6 Bytes JMP 707F000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!MoveFileA 7C835EBF 6 Bytes JMP 7088000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!MoveFileExA 7C85E49B 6 Bytes JMP 7082000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CopyFileExA 7C85F39C 4 Bytes JMP EC001E25
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CopyFileExA + 5 7C85F3A1 1 Byte [70]
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!SetThreadContext 7C863C09 6 Bytes JMP 70C8000A
    .text C:\WINDOWS\System32\svchost.exe[1284] kernel32.dll!CreateToolhelp32Snapshot 7C865C7F 6 Bytes JMP 7111000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegOpenKeyExW 77DD6AAF 6 Bytes JMP 712C000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegQueryValueExW 77DD6FFF 6 Bytes JMP 711A000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegCreateKeyExW 77DD776C 6 Bytes JMP 713E000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegOpenKeyExA 77DD7852 6 Bytes JMP 712F000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegOpenKeyW 77DD7946 6 Bytes JMP 7132000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!OpenProcessToken 77DD798B 6 Bytes JMP 70C5000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegQueryValueExA 77DD7ABB 6 Bytes JMP 711D000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegSetValueExW 77DDD767 6 Bytes JMP 7126000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegQueryValueW 77DDD87A 6 Bytes JMP 7120000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegCreateKeyExA 77DDE9F4 6 Bytes JMP 7141000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegSetValueExA 77DDEAE7 6 Bytes JMP 7129000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegOpenKeyA 77DDEFC8 6 Bytes JMP 7135000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!AdjustTokenPrivileges 77DDF00C 6 Bytes JMP 70BC000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegDeleteKeyA 77DE42A0 6 Bytes JMP 7098000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegDeleteKeyW 77DE559B 6 Bytes JMP 7095000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!OpenSCManagerW 77DE6F55 6 Bytes JMP 7102000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!OpenSCManagerA 77DF69AE 3 Bytes [FF, 25, 1E]
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!OpenSCManagerA + 4 77DF69B2 2 Bytes [04, 71] {ADD AL, 0x71}
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!LookupPrivilegeValueW 77DFB8DF 6 Bytes JMP 70BF000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegCreateKeyW 77DFBA55 6 Bytes JMP 7138000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegQueryValueA 77DFBB8D 6 Bytes JMP 7123000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!RegCreateKeyA 77DFBCF3 6 Bytes JMP 713B000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!LookupPrivilegeValueA 77DFC238 6 Bytes JMP 70C2000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!CreateServiceA 77E37211 6 Bytes JMP 7156000A
    .text C:\WINDOWS\System32\svchost.exe[1284] ADVAPI32.dll!CreateServiceW 77E373A9 6 Bytes JMP 7153000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!SetWindowTextW 7E42960E 6 Bytes JMP 708F000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetCursorPos 7E42974E 5 Bytes JMP 010E000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!WindowFromPoint 7E429766 5 Bytes JMP 010F000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetForegroundWindow 7E429823 5 Bytes JMP 0110000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetWindowTextW 7E42A5CD 6 Bytes JMP 70FC000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetAsyncKeyState 7E42A78F 6 Bytes JMP 7165000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!ShowWindow 7E42AF56 3 Bytes [FF, 25, 1E]
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!ShowWindow + 4 7E42AF5A 2 Bytes [F8, 70]
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!DrawTextExW 7E42B415 6 Bytes JMP 70DE000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!CreateWindowExW 7E42D0A3 6 Bytes JMP 70A1000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetKeyboardState 7E42D226 3 Bytes [FF, 25, 1E]
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetKeyboardState + 4 7E42D22A 2 Bytes [61, 71]
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!DrawTextW 7E42D7E2 6 Bytes JMP 70A7000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!CreateWindowExA 7E42E4A9 6 Bytes JMP 70A4000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!SetWindowTextA 7E42F56B 6 Bytes JMP 7092000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!SetWinEventHook 7E4317F7 6 Bytes JMP 7150000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!GetWindowTextA 7E43216B 6 Bytes JMP 70FF000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!DrawTextA 7E43C702 6 Bytes JMP 70AA000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!DrawTextExA 7E43C739 6 Bytes JMP 70E1000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!DdeConnect 7E4581C3 6 Bytes JMP 715F000A
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!RegisterRawInputDevices 7E46CE0E 3 Bytes [FF, 25, 1E]
    .text C:\WINDOWS\System32\svchost.exe[1284] USER32.dll!RegisterRawInputDevices + 4 7E46CE12 2 Bytes [4C, 71]
    .text C:\WINDOWS\System32\svchost.exe[1284] ole32.dll!CoCreateInstance 774FF1AC 5 Bytes JMP 00E5000A
    .text C:\WINDOWS\System32\svchost.exe[1284] SHELL32.dll!Shell_NotifyIcon 7CA28BC6 6 Bytes JMP 70E7000A
    .text C:\WINDOWS\System32\svchost.exe[1284] SHELL32.dll!Shell_NotifyIconW 7CA2A537 6 Bytes JMP 70E4000A
    .text C:\WINDOWS\System32\svchost.exe[1284] WININET.dll!InternetOpenUrlA 3D95F3AC 6 Bytes JMP 70D8000A
    .text C:\WINDOWS\System32\svchost.exe[1284] WININET.dll!InternetOpenUrlW 3D9A6D6F 6 Bytes JMP 70D5000A
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A80001
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\svchost.exe[1468] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1500] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 209B37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[1600] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1692] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Google\Update\GoogleUpdate.exe[1712] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] ntdll.dll!
     
    sallnjackn,
    #4
  6. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1760] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A70001
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] kernel32.dll!OpenProcess 7C8309E9 6 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\SOUNDMAN.EXE[1824] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[1848] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A70001
    .text C:\WINDOWS\System32\svchost.exe[2212] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2212] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\system32\nvsvc32.exe[2296] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71A70001
    .text C:\WINDOWS\System32\svchost.exe[2668] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7426 5 Bytes JMP 20C78E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] ADVAPI32.dll!SetThreadToken 77DDF193 5 Bytes JMP 20C79036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\WINDOWS\System32\svchost.exe[2668] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] ntdll.dll!NtAccessCheckByType 7C90CE8E 5 Bytes JMP 20C78791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] ntdll.dll!NtImpersonateClientOfPort 7C90D3FE 5 Bytes JMP 20C78D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] ntdll.dll!NtSetInformationProcess 7C90DC9E 5 Bytes JMP 20C789AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] kernel32.dll!OpenProcess 7C8309E9 5 Bytes JMP 20C7846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] USER32.dll!FindWindowA 7E4282E1 5 Bytes JMP 20C7828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    .text C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe[2712] USER32.dll!FindWindowW 7E42C9C3 5 Bytes JMP 20C7825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
     
    sallnjackn,
    #5
  7. 2011/12/17
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    ---- Kernel IAT/EAT - GMER 1.0.15 ----

    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\system32\DRIVERS\tcpip6.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\arp1394.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [EBB9B3C4] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [EBBBD672] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [EBBBBC2A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [EBBBDCBA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [EBBBD4C8] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [EBBB42AA] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [EBBB460C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [EBBB3D40] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)
    IAT \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [EBBB441C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    ---- User IAT/EAT - GMER 1.0.15 ----

    IAT C:\WINDOWS\System32\svchost.exe[192] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[252] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Bonjour\mDNSResponder.exe[556] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\spoolsv.exe[652] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\winlogon.exe[848] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\services.exe[900] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\lsass.exe[920] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT F:\Program Files\msworks calendar\WKCALREM.EXE[948] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\wuauclt.exe[1064] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\svchost.exe[1108] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\svchost.exe[1176] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[1284] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT F:\Program Files\Ahead\InCD\InCDsrv.exe[1356] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\svchost.exe[1468] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe[1492] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[1500] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe[1568] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe[1680] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Google\Update\GoogleUpdate.exe[1692] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Google\Update\GoogleUpdate.exe[1712] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe[1720] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[1760] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\SOUNDMAN.EXE[1824] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[1848] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[1860] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Windows Media Player\WMPNSCFG.exe[1872] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\LSI SoftModem\agrsmsvc.exe[1984] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\SUPERAntiSpyware\SASCORE.EXE[2016] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[2212] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\nvsvc32.exe[2296] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[2512] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[2668] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\alg.exe[2748] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe[2808] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\ctfmon.exe[2884] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe[3152] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe[3180] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe[3544] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[3620] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Documents and Settings\Sallie\Desktop\x9h796rv.exe[3684] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\system32\SearchIndexer.exe[3724] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe[3996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\Program Files\Google\Update\GoogleUpdate.exe[4460] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\explorer.exe[4496] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtCreateFile] [00C72F20] C:\WINDOWS\TEMP\logishrd\LVPrcInj02.dll (Camera Helper Library./Logitech Inc.)
    IAT C:\WINDOWS\explorer.exe[4496] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDeviceIoControlFile] [00C72C90] C:\WINDOWS\TEMP\logishrd\LVPrcInj02.dll (Camera Helper Library./Logitech Inc.)
    IAT C:\WINDOWS\explorer.exe[4496] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtClose] [00C72CF0] C:\WINDOWS\TEMP\logishrd\LVPrcInj02.dll (Camera Helper Library./Logitech Inc.)
    IAT C:\WINDOWS\explorer.exe[4496] @ C:\WINDOWS\system32\kernel32.dll [ntdll.dll!NtDuplicateObject] [00C72CC0] C:\WINDOWS\TEMP\logishrd\LVPrcInj02.dll (Camera Helper Library./Logitech Inc.)
    IAT C:\WINDOWS\explorer.exe[4496] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)
    IAT C:\WINDOWS\System32\svchost.exe[5908] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20C7835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies)

    ---- Devices - GMER 1.0.15 ----

    AttachedDevice \FileSystem\Ntfs \Ntfs TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)
    AttachedDevice \FileSystem\Ntfs \Ntfs TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)

    Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Ip pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

    Device \Driver\Tcpip6 \Device\Ip6 pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
    Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Tcp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T1L0-17 872032C6
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort0 872032C6
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP0T0L0-3 872032C6
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdePort1 872032C6
    Device \Driver\atapi -> DriverStartIo \Device\Ide\IdeDeviceP1T0L0-f 872032C6
    Device \Driver\Tcpip6 \Device\RawIp6 pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
    Device \Driver\Tcpip6 \Device\Tcp6 pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
    Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\Udp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

    Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \Driver\Tcpip \Device\RawIp pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)

    Device \Driver\Tcpip6 \Device\Udp6 pctgntdi.sys (PC Tools Generic TDI Driver/PC Tools)
    Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD)

    AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
    AttachedDevice \FileSystem\Fastfat \Fat TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)
    AttachedDevice \FileSystem\Fastfat \Fat TfFsMon.sys (ThreatFire Filesystem Monitor/PC Tools)

    ---- Disk sectors - GMER 1.0.15 ----

    Disk \Device\Harddisk0\DR0 TDL4@MBR code has been found <-- ROOTKIT !!!
    Disk \Device\Harddisk0\DR0 sector 00: rootkit-like behavior

    ---- EOF - GMER 1.0.15 ----
     
    sallnjackn,
    #6
  8. 2011/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please, observe following rules:
    • Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
    • If you're stuck, or you're not sure about certain step, always ask before doing anything else.
    • Please refrain from running tools or applying updates other than those I suggest.
    • Never run more than one scan at a time.
    • Keep updating me regarding your computer behavior, good, or bad.
    • The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
    • If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
    • I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

    =========================================================

    Go on....
     
    broni,
    #7
  9. 2011/12/18
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-12-18 13:41:35
    -----------------------------
    13:41:35.875 OS Version: Windows 5.1.2600 Service Pack 3
    13:41:35.921 Number of processors: 1 586 0x801
    13:41:35.984 ComputerName: SALLIE-DESKTOP UserName: Sallie
    13:42:22.234 Initialize success
    13:44:52.703 AVAST engine defs: 11121801
    13:45:23.796 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    13:45:23.796 Disk 0 Vendor: WDC_WD5000AAKB-00H8A0 05.04E05 Size: 476940MB BusType: 3
    13:45:23.812 Device \Driver\atapi -> DriverStartIo 869a12c6
    13:45:25.812 Disk 0 MBR read successfully
    13:45:25.828 Disk 0 MBR scan
    13:45:25.875 Disk 0 MBR:pihar-B [Rtk]
    13:45:25.890 Disk 0 TDL4@MBR code has been found
    13:45:25.890 Disk 0 Windows XP default MBR code found via API
    13:45:25.890 Disk 0 MBR hidden
    13:45:25.906 Disk 0 MBR [TDL4] **ROOTKIT**
    13:45:25.906 Disk 0 trace - called modules:
    13:45:25.921 ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll >>UNKNOWN [0x869a149f]<<
    13:45:25.921 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87347ab8]
    13:45:25.937 3 CLASSPNP.SYS[f7793fd7] -> nt!IofCallDriver -> [0x87362920]
    13:45:25.968 5 PCTCore.sys[f761a407] -> nt!IofCallDriver -> \Device\00000075[0x8738ff18]
    13:45:25.984 7 ACPI.sys[f76ba620] -> nt!IofCallDriver -> [0x8738c940]
    13:45:26.000 \Driver\atapi[0x86cce300] -> IRP_MJ_CREATE -> 0x869a149f
    13:45:26.359 AVAST engine scan C:\WINDOWS
    13:45:42.375 AVAST engine scan C:\WINDOWS\system32
    13:51:19.062 AVAST engine scan C:\WINDOWS\system32\drivers
    13:52:07.812 AVAST engine scan C:\Documents and Settings\Sallie
    14:08:34.765 AVAST engine scan C:\Documents and Settings\All Users
    14:09:07.406 Scan finished successfully
    18:58:10.968 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Sallie\Desktop\MBR.dat "
    18:58:10.984 The log file has been saved successfully to "C:\Documents and Settings\Sallie\Desktop\aswMBR.txt "
     
    sallnjackn,
    #8
  10. 2011/12/18
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    .
    DDS (Ver_2011-08-26.01) - NTFSx86
    Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_27
    Run by Sallie at 19:19:31 on 2011-12-18
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.163 [GMT -6:00]
    .
    AV: PC Tools Spyware Doctor with AntiVirus *Enabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
    AV: Norton Security Suite *Enabled/Updated* {E10A9785-9598-4754-B552-92431C1C35F8}
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    FW: ZoneAlarm Firewall *Enabled*
    FW: Norton Security Suite *Enabled*
    .
    ============== Running Processes ===============
    .
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    F:\Program Files\Ahead\InCD\InCDsrv.exe
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
    C:\Program Files\LSI SoftModem\agrsmsvc.exe
    C:\WINDOWS\System32\svchost.exe -k Akamai
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe
    C:\WINDOWS\system32\svchost.exe -k hpdevmgmt
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\Linksys\Linksys Updater\bin\LinksysUpdater.exe
    C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    C:\WINDOWS\system32\java.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe -k HPZ12
    C:\Program Files\PC Tools\PC Tools Security\pctsAuxs.exe
    C:\Program Files\PC Tools\PC Tools Security\pctsSvc.exe
    C:\WINDOWS\System32\svchost.exe -k imgsvc
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\Program Files\Common Files\Pure Networks Shared\Platform\nmsrvc.exe
    C:\Program Files\PC Tools\PC Tools Security\pctsGui.exe
    C:\Program Files\PC Tools\PC Tools Security\TFEngine\TFService.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqSRMon.exe
    C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Media Player\WMPNSCFG.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\iPod\bin\iPodService.exe
    F:\Program Files\msworks calendar\WKCALREM.EXE
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\CheckPoint\ZAForceField\ForceField.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\Google\Update\GoogleUpdate.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Sallie\Desktop\aswMBR.exe
    C:\WINDOWS\system32\SearchProtocolHost.exe
    .
    ============== Pseudo HJT Report ===============
    .
    uStart Page =
    uSearch Page = hxxp://www.google.com
    uSearch Bar = hxxp://www.google.com/ie
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = 192.168.*.*;*.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    uURLSearchHooks: PC Tools Browser Defender: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
    uURLSearchHooks: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\prxtbZone.dll
    BHO: HP Print Enhancer: {0347c33e-8762-4905-bf09-768834316c61} - c:\program files\hp\digital imaging\smart web printing\hpswp_printenhancer.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: PC Tools Browser Defender BHO: {2a0f3d1b-0909-4ff4-b272-609cce6054e7} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
    BHO: ZoneAlarm Security Engine Registrar: {8a4a36c2-0535-4d2c-bd3d-496cb7eed6e3} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\prxtbZone.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: HP Smart BHO Class: {ffffffff-cf4e-4f2b-bdc2-0e72e116a856} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    TB: PC Tools Browser Defender: {472734ea-242a-422b-adf8-83d1e48cc825} - c:\program files\pc tools\pc tools security\bdt\PCTBrowserDefender.dll
    TB: ZoneAlarm Security Toolbar: {91da5e8a-3318-4f8c-b67e-5964de3ab546} - c:\program files\zonealarm_security\prxtbZone.dll
    TB: ZoneAlarm Security Engine: {ee2ac4e5-b0b0-4ec6-88a9-bca1a32ab107} - c:\program files\checkpoint\zaforcefield\trustchecker\bin\TrustCheckerIEPlugin.dll
    EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    uRun: [WMPNSCFG] c:\program files\windows media player\WMPNSCFG.exe
    uRun: [SUPERAntiSpyware] c:\program files\superantispyware\SUPERAntiSpyware.exe
    mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
    mRun: [hpqSRMon] c:\program files\hp\digital imaging\bin\hpqSRMon.exe
    mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot
    mRun: [NvCplDaemon] RUNDLL32.EXE c:\windows\system32\NvCpl.dll,NvStartup
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    mRun: [SoundMan] SOUNDMAN.EXE
    mRun: [ISTray] "c:\program files\pc tools\pc tools security\pctsGui.exe" /hideGUI
    mRun: [ZoneAlarm Installer] "c:\program files\checkpoint\install\launcher.exe" "c:\program files\checkpoint\install\install.exe" /r download /c "c:\program files\checkpoint\install\Install.xml" /l /w
    mRun: [ZoneAlarm Client] "c:\program files\zone labs\zonealarm\zlclient.exe "
    mRun: [ISW] "c:\program files\checkpoint\zaforcefield\ForceField.exe" /icon= "hidden "
    dRun: [DWQueuedReporting] "c:\progra~1\common~1\micros~1\dw\dwtrig20.exe" -t
    StartupFolder: c:\docume~1\sallie\startm~1\programs\startup\micros~1.lnk - f:\program files\msworks calendar\WKCALREM.EXE
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - f:\progra~1\micros~1\office11\EXCEL.EXE/3000
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - f:\progra~1\micros~1\office11\REFIEBAR.DLL
    IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
    LSP: c:\program files\common files\pc tools\lsp\PCTLsp.dll
    Trusted Zone: microsoft.com\*.update
    Trusted Zone: microsoft.com\www.update
    Trusted Zone: windowsupdate.com\download
    DPF: {0067DBFC-A752-458C-AE6E-B9C7E63D4824} - hxxp://www.logitech.com/devicedetector/plugins/LogitechDeviceDetection32.cab
    DPF: {02BCC737-B171-4746-94C9-0D8A0B2C0089} - hxxp://office.microsoft.com/sites/production/ieawsdc32.cab
    DPF: {0742B9EF-8C83-41CA-BFBA-830A59E23533} - hxxps://support.microsoft.com/Dcode/ActiveX/MSDcode.cab
    DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1280869658700
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1280870744203
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} -
    DPF: {FE5B9F54-7764-4C01-89F0-4862601EE954} - hxxp://photos.msn.com/resources/neutral/controls/DigWebX2.cab?10,0,910,0
    TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 75.75.76.76 75.75.75.75
    TCP: Interfaces\{37E3F16E-6217-4ADC-92F8-869AD1F148B2} : DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 75.75.76.76 75.75.75.75
    Handler: belarc - {6318E0AB-2E93-11D1-B8ED-00608CC9A71F} - c:\program files\belarc\advisor\system\BAVoilaX.dll
    Handler: pure-go - {4746C79A-2042-4332-8650-48966E44ABA8} - c:\program files\common files\pure networks shared\platform\puresp3.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.DLL
    Notify: LBTWlgn - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL
    LSA: Notification Packages = scecli scecli
    Hosts: 127.0.0.1 www.spywareinfo.com
    .
    ================= FIREFOX ===================
    .
    FF - ProfilePath - c:\documents and settings\sallie\application data\mozilla\firefox\profiles\7ou8f9pk.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2860551&SearchSource=3&q={searchTerms}
    FF - prefs.js: browser.startup.homepage - hxxp://my.earthlink.net/|http://webmail.earthlink.net/wam/index.jsp
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
    FF - plugin: c:\documents and settings\sallie\application data\move networks\plugins\npqmp071706000001.dll
    FF - plugin: c:\documents and settings\sallie\application data\mozilla\firefox\profiles\7ou8f9pk.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
    FF - plugin: c:\documents and settings\sallie\application data\mozilla\firefox\profiles\7ou8f9pk.default\extensions\devicedetection@logitech.com\plugins\npLogitechDeviceDetection.dll
    FF - plugin: c:\documents and settings\sallie\application data\mozilla\plugins\npgoogletalk.dll
    FF - plugin: c:\documents and settings\sallie\application data\mozilla\plugins\npgtpo3dautoplugin.dll
    FF - plugin: c:\documents and settings\sallie\local settings\application data\google\update\1.3.21.69\npGoogleUpdate3.dll
    FF - plugin: c:\program files\adobe\reader 10.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\adobe\reader 9.0\reader\air\nppdf32.dll
    FF - plugin: c:\program files\checkpoint\zaforcefield\trustchecker\bin\npFFApi.dll
    FF - plugin: c:\program files\google\google earth\plugin\npgeplugin.dll
    FF - plugin: c:\program files\google\update\1.3.21.57\npGoogleUpdate3.dll
    FF - plugin: c:\program files\google\update\1.3.21.65\npGoogleUpdate3.dll
    FF - plugin: c:\program files\google\update\1.3.21.69\npGoogleUpdate3.dll
    FF - plugin: c:\program files\google\update\1.3.21.79\npGoogleUpdate3.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft silverlight\4.0.60831.0\npctrlui.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\mozilla firefox\plugins\npdeployJava1.dll
    FF - plugin: c:\program files\radiopi_4eei\installr\2.bin\NP4eEISb.dll
    FF - plugin: f:\program files\google\picasa3\npPicasa3.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin2.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin3.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin4.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin5.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin6.dll
    FF - plugin: f:\program files\quicktime\plugins\npqtplugin7.dll
    .
    ============= SERVICES / DRIVERS ===============
    .
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [2011-12-5 331880]
    R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [2011-12-5 341656]
    R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [2011-12-5 660992]
    R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [2011-12-5 54328]
    R0 TFSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [2011-12-5 574424]
    R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [2011-12-5 253096]
    R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [2011-12-5 185560]
    R1 SASDIFSV;SASDIFSV;c:\program files\superantispyware\sasdifsv.sys [2011-7-22 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\superantispyware\SASKUTIL.SYS [2011-7-12 67664]
    R1 vsdatant;vsdatant;c:\windows\system32\vsdatant.sys [2011-12-13 532224]
    R2 !SASCORE;SAS Core Service;c:\program files\superantispyware\SASCore.exe [2011-8-11 116608]
    R2 Akamai;Akamai NetSession Interface;c:\windows\system32\svchost.exe -k Akamai [2003-3-31 14336]
    R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\pc tools\pc tools security\bdt\BDTUpdateService.exe [2011-12-5 546768]
    R2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-11-15 136176]
    R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\checkpoint\zaforcefield\ISWKL.sys [2011-2-15 26872]
    R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\checkpoint\zaforcefield\ISWSVC.exe [2011-2-15 488952]
    R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [2010-8-7 10448]
    R2 LinksysUpdater;Linksys Updater;c:\program files\linksys\linksys updater\bin\LinksysUpdater.exe [2008-4-18 204800]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia updatus\daemonu.exe [2011-10-17 2255464]
    R2 sdAuxService;PC Tools Auxiliary Service;c:\program files\pc tools\pc tools security\pctsAuxs.exe [2011-12-5 402336]
    R2 sdCoreService;PC Tools Security Service;c:\program files\pc tools\pc tools security\pctsSvc.exe [2011-12-5 1117624]
    R2 vsmon;TrueVector Internet Monitor;c:\windows\system32\zonelabs\vsmon.exe -service --> c:\windows\system32\zonelabs\vsmon.exe -service [?]
    R3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [2011-12-5 56840]
    R3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [2011-12-5 70536]
    R3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [2011-12-5 35264]
    R3 ThreatFire;ThreatFire;c:\program files\pc tools\pc tools security\tfengine\tfservice.exe service --> c:\program files\pc tools\pc tools security\tfengine\TFService.exe service [?]
    S1 MpKsl0625c6cc;MpKsl0625c6cc;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{1dd2cbc7-8dde-461b-8953-2d307f434e08}\mpksl0625c6cc.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{1dd2cbc7-8dde-461b-8953-2d307f434e08}\MpKsl0625c6cc.sys [?]
    S1 MpKsl234310a4;MpKsl234310a4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2a52ffa1-b978-4216-9d0a-e54b573dd3ff}\mpksl234310a4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2a52ffa1-b978-4216-9d0a-e54b573dd3ff}\MpKsl234310a4.sys [?]
    S1 MpKsl321f7044;MpKsl321f7044;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ff067be6-8296-44fe-8032-0619cda3788f}\mpksl321f7044.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{ff067be6-8296-44fe-8032-0619cda3788f}\MpKsl321f7044.sys [?]
    S1 MpKsl6a0c865a;MpKsl6a0c865a;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2f0a814-2899-405a-bbef-91e7605e5889}\mpksl6a0c865a.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{e2f0a814-2899-405a-bbef-91e7605e5889}\MpKsl6a0c865a.sys [?]
    S1 MpKsla6aa0de4;MpKsla6aa0de4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{050f2003-90c5-42ea-89b4-7b6a343e4645}\mpksla6aa0de4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{050f2003-90c5-42ea-89b4-7b6a343e4645}\MpKsla6aa0de4.sys [?]
    S1 MpKslb79564a4;MpKslb79564a4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{65da83d6-f52c-426f-8dfe-4a6cee602600}\mpkslb79564a4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{65da83d6-f52c-426f-8dfe-4a6cee602600}\MpKslb79564a4.sys [?]
    S1 MpKslcccbc33e;MpKslcccbc33e;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f87185d-e90a-4c89-9d50-916a2d8a0fa0}\mpkslcccbc33e.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{2f87185d-e90a-4c89-9d50-916a2d8a0fa0}\MpKslcccbc33e.sys [?]
    S1 MpKslf53aab93;MpKslf53aab93;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c375d6bf-655a-4b88-897f-d7a98dfdc5f4}\mpkslf53aab93.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c375d6bf-655a-4b88-897f-d7a98dfdc5f4}\MpKslf53aab93.sys [?]
    S1 MpKslf9b43df4;MpKslf9b43df4;\??\c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c4bbf18e-e426-4e44-9037-cce182730bef}\mpkslf9b43df4.sys --> c:\documents and settings\all users\application data\microsoft\microsoft antimalware\definition updates\{c4bbf18e-e426-4e44-9037-cce182730bef}\MpKslf9b43df4.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 mrtRate;mrtRate; [x]
    S3 cpuz132;cpuz132;\??\c:\docume~1\sallie\locals~1\temp\cpuz132\cpuz132_x32.sys --> c:\docume~1\sallie\locals~1\temp\cpuz132\cpuz132_x32.sys [?]
    S3 cpuz135;cpuz135;\??\c:\windows\temp\cpuz135\cpuz135_x32.sys --> c:\windows\temp\cpuz135\cpuz135_x32.sys [?]
    S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\common files\futuremark shared\futuremark systeminfo\FMSISvc.exe [2011-4-10 129440]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2010-11-15 136176]
    S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2010-6-24 21504]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [2008-8-21 20480]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-8-21 8320]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [2011-8-8 24064]
    S3 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [2003-1-29 14416]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2003-3-31 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    .
    =============== Created Last 30 ================
    .
    2103-01-01 05:21:39 -------- d-----w- c:\documents and settings\sallie\local settings\application data\PCHealth
    2011-12-13 15:35:36 -------- d-----w- c:\documents and settings\sallie\local settings\application data\ZoneAlarm_Security
    2011-12-13 15:35:29 -------- d-----w- c:\program files\ZoneAlarm_Security
    2011-12-13 15:32:58 1238528 ----a-w- c:\windows\system32\zpeng25.dll
    2011-12-13 05:11:14 -------- d-----w- c:\documents and settings\sallie\application data\CheckPoint
    2011-12-13 04:10:38 -------- d-----w- c:\windows\system32\ZoneLabs
    2011-12-13 04:10:31 -------- d-----w- c:\program files\Zone Labs
    2011-12-13 04:09:09 -------- d-----w- c:\windows\Internet Logs
    2011-12-13 03:58:46 -------- d-----w- c:\program files\CheckPoint
    2011-12-09 05:03:37 -------- d-----w- c:\documents and settings\sallie\local settings\application data\Threat Expert
    2011-12-05 23:30:25 574424 --s---w- c:\windows\system32\drivers\TfSysMon.sys
    2011-12-05 23:30:25 54328 --s---w- c:\windows\system32\drivers\TfFsMon.sys
    2011-12-05 23:30:25 35264 --s---w- c:\windows\system32\drivers\TfNetMon.sys
    2011-12-05 23:14:47 56840 ----a-w- c:\windows\system32\drivers\PCTBD.sys
    2011-12-05 23:14:46 767952 ----a-w- c:\windows\BDTSupport.dll
    2011-12-05 23:14:46 149456 ----a-w- c:\windows\SGDetectionTool.dll
    2011-12-05 23:14:45 2246608 ----a-w- c:\windows\PCTBDCore.dll
    2011-12-05 23:14:45 1681360 ----a-w- c:\windows\PCTBDRes.dll
    2011-12-05 23:10:24 253096 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2011-12-05 23:10:01 17848 ----a-w- c:\windows\system32\drivers\pctBTFix.sys
    2011-12-05 23:09:53 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2011-12-05 23:09:38 -------- d-----w- c:\program files\PC Tools
    2011-12-05 23:06:39 660992 ----a-w- c:\windows\system32\drivers\pctEFA.sys
    2011-12-05 23:06:39 341656 ----a-w- c:\windows\system32\drivers\pctDS.sys
    2011-12-05 23:06:05 331880 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2011-12-05 23:06:05 162584 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2011-12-05 23:06:00 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys
    2011-12-05 14:38:16 -------- d-----w- c:\documents and settings\sallie\application data\TestApp
    2011-12-04 00:15:17 49152 ----a-w- c:\windows\system32\ChCfg.exe
    2011-12-04 00:12:27 4122368 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
    2011-12-04 00:10:02 -------- d-----w- c:\program files\Realtek AC97
    2011-12-04 00:10:00 10528768 ----a-w- c:\windows\system32\RTLCPL.exe
    2011-12-04 00:09:58 577536 ----a-w- c:\windows\soundman.exe
    2011-12-04 00:09:58 18804736 ----a-w- c:\windows\system32\alsndmgr.cpl
    2011-12-04 00:09:58 147456 ----a-w- c:\windows\system32\RtlCPAPI.dll
    2011-12-04 00:09:55 315392 ----a-w- c:\windows\alcupd.exe
    2011-12-04 00:09:54 217088 ----a-w- c:\windows\Alcrmv.exe
    2011-12-04 00:09:06 274432 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iscript.dll
    2011-12-04 00:09:06 204800 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iuser.dll
    2011-12-04 00:09:05 69715 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\ctor.dll
    2011-12-04 00:09:05 5632 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\DotNetInstaller.exe
    2011-12-04 00:09:04 757760 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iKernel.dll
    2011-12-04 00:08:53 200836 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\iGdi.dll
    2011-12-04 00:08:50 331908 ----a-w- c:\program files\common files\installshield\professional\runtime\11\50\intel32\setup.dll
    2011-12-03 05:14:34 84480 -c--a-w- c:\windows\system32\dllcache\ac97via.sys
    2011-12-03 05:14:34 84480 ----a-w- c:\windows\system32\drivers\ac97via.sys
    2011-11-27 02:49:39 258 ----a-w- C:\cc_20111126_204921.reg
    2011-11-26 03:14:11 -------- d-----w- c:\documents and settings\all users\application data\PopCap Games
    2011-11-26 03:13:11 -------- d-----w- c:\program files\PopCap Games
    2011-11-25 01:26:17 -------- d-----w- c:\documents and settings\sallie\application data\SUPERAntiSpyware.com
    2011-11-25 01:25:27 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-11-25 01:25:27 -------- d-----w- c:\documents and settings\all users\application data\SUPERAntiSpyware.com
    2011-11-25 00:25:03 1618 ----a-w- C:\cc_20111124_182501.reg
    2011-11-25 00:24:22 380492 ----a-w- C:\cc_20111124_182412.reg
    2011-11-23 05:13:01 -------- d-----w- c:\program files\SpeedFan
    2011-11-22 00:45:00 -------- d-----w- c:\program files\Microsoft
    2011-11-22 00:38:48 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
    2011-11-19 20:23:37 -------- d-----w- c:\documents and settings\sallie\application data\Malwarebytes
    2011-11-19 20:23:01 -------- d-----w- c:\documents and settings\all users\application data\Malwarebytes
    2011-11-19 20:22:48 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    2011-11-19 20:22:48 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    .
    ==================== Find3M ====================
    .
    2011-11-14 19:49:00 7077 ----a-w- c:\windows\system32\0.8428795835251978.exe
    2011-11-14 19:45:15 7077 ----a-w- c:\windows\system32\0.6738751965356143.exe
    2011-11-14 19:45:13 7077 ----a-w- c:\windows\system32\0.5021618371150453.exe
    2011-11-14 04:23:09 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-11-09 05:16:18 7077 ----a-w- c:\windows\system32\0.8949212417061244.exe
    2011-10-17 14:21:19 280276 ----a-w- c:\windows\system32\nvdrsdb0.bin
    2011-10-17 14:21:19 1 ----a-w- c:\windows\system32\nvdrssel.bin
    2011-10-17 14:21:08 280276 ----a-w- c:\windows\system32\nvdrsdb1.bin
    2011-10-10 14:22:41 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-28 07:06:50 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-26 16:41:20 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 16:41:20 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 16:41:14 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    .
    =================== ROOTKIT ====================
    .
    Stealth MBR rootkit/Mebroot/Sinowal/TDL4 detector 0.4.2 by Gmer, http://www.gmer.net
    Windows 5.1.2600 Disk: WDC_WD5000AAKB-00H8A0 rev.05.04E05 -> Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    .
    device: opened successfully
    user: MBR read successfully
    .
    Disk trace:
    called modules: ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll >>UNKNOWN [0x869A149F]<<
    c:\windows\system32\drivers\PCTCore.sys PC Tools Kernel Driver Suite
    _asm { PUSH EBP; MOV EBP, ESP; PUSH ECX; MOV EAX, [EBP+0x8]; CMP EAX, [0x869a8728]; MOV EAX, [0x869a889c]; PUSH EBX; PUSH ESI; MOV ESI, [EBP+0xc]; MOV EBX, [ESI+0x60]; PUSH EDI; JNZ 0x20; MOV [EBP+0x8], EAX; }
    1 nt!IofCallDriver[0x804E37D5] -> \Device\Harddisk0\DR0[0x87347AB8]
    3 CLASSPNP[0xF7793FD7] -> nt!IofCallDriver[0x804E37D5] -> [0x87362920]
    5 PCTCore[0xF761A407] -> nt!IofCallDriver[0x804E37D5] -> \Device\00000075[0x8738FF18]
    7 ACPI[0xF76BA620] -> nt!IofCallDriver[0x804E37D5] -> [0x8738C940]
    \Driver\atapi[0x86CCE300] -> IRP_MJ_CREATE -> 0x869A149F
    error: Read A device attached to the system is not functioning.
    kernel: MBR read successfully
    _asm { XOR AX, AX; MOV SS, AX; MOV SP, 0x7c00; STI ; PUSH AX; POP ES; PUSH AX; POP DS; CLD ; MOV SI, 0x7c1b; MOV DI, 0x61b; PUSH AX; PUSH DI; MOV CX, 0x1e5; REP MOVSB ; RETF ; MOV BP, 0x7be; MOV CL, 0x4; CMP [BP+0x0], CH; JL 0x2e; JNZ 0x3a; }
    detected disk devices:
    detected hooks:
    \Driver\atapi DriverStartIo -> 0x869A12C6
    user & kernel MBR OK
    Warning: possible TDL3 rootkit infection !
    .
    ============= FINISH: 19:31:42.12 ===============
    .
    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT
    .
    DDS (Ver_2011-08-26.01)
    .
    Microsoft Windows XP Home Edition
    Boot Device: \Device\HarddiskVolume1
    Install Date: 8/3/2010 3:07:54 PM
    System Uptime: 12/18/2011 8:00:09 AM (11 hours ago)
    .
    Motherboard: http://www.abit.com.tw/ | | KD7A(VIA KT400A-8235)
    Processor: AMD Athlon(tm) XP 1500+ | Socket 7 | 1353/135mhz
    .
    ==== Disk Partitions =========================
    .
    A: is Removable
    C: is FIXED (NTFS) - 47 GiB total, 16.359 GiB free.
    D: is CDROM ()
    E: is CDROM ()
    F: is FIXED (NTFS) - 419 GiB total, 407.975 GiB free.
    G: is Removable
    H: is FIXED (FAT32) - 19 GiB total, 9.914 GiB free.
    J: is FIXED (FAT32) - 19 GiB total, 8.585 GiB free.
    .
    ==== Disabled Device Manager Items =============
    .
    ==== System Restore Points ===================
    .
    RP9: 12/16/2011 8:05:51 PM - System Checkpoint
    RP10: 12/17/2011 9:59:56 PM - System Checkpoint
    RP11: 12/18/2011 12:12:14 AM - Software Distribution Service 3.0
    RP12: 12/18/2011 8:30:10 AM - Software Distribution Service 3.0
    .
    ==== Installed Programs ======================
    .
    32 Bit HP CIO Components Installer
    7-Zip 4.65
    Adobe AIR
    Adobe Digital Editions
    Adobe Flash Player 11 ActiveX
    Adobe Flash Player 11 Plugin
    Adobe Reader X (10.1.1)
    Adobe Shockwave Player 11.6
    Agere Systems PCI Soft Modem
    AIO_Scan
    Akamai NetSession Interface
    Akamai NetSession Interface Service
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AtomTime Pro 3.1d
    Avery Wizard 4.0
    Batch PDF Merger
    Belarc Advisor 8.2
    Bonjour
    Browser Defender 4.0
    BufferChm
    C5200
    C5200_Help
    Cards_Calendar_OrderGift_DoMorePlugout
    CCleaner
    Compatibility Pack for the 2007 Office system
    Copy
    CustomerResearchQFolder
    Destination Component
    DeviceDiscovery
    DeviceManagementQFolder
    DiskCheckup v3.0.1006
    DocProc
    DocProcQFolder
    eReg
    eSupportQFolder
    EVEREST Ultimate Edition v5.50
    Exact Audio Copy 0.99pb3
    Fax
    Fomine Net Send GUI
    FoxTab PDF Converter
    Futuremark SystemInfo
    Google Chrome
    Google Earth
    Google Talk Plugin
    Google Update Helper
    GPBaseService
    HandBrake 0.9.5
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
    Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
    Hotfix for Windows XP (KB954550-v5)
    HP Customer Participation Program 10.0
    HP Imaging Device Functions 10.0
    HP Photosmart All-In-One Driver Software 10.0 Rel .2
    HP Photosmart Essential 3.5
    HP Smart Web Printing
    HP Solution Center 10.0
    HP Update
    HPPhotoSmartDiscLabel_PaperLabel
    HPPhotoSmartDiscLabel_PrintOnDisc
    HPPhotoSmartDiscLabelContent1
    hpphotosmartdisclabelplugin
    HPPhotosmartEssential
    HPPhotoSmartPhotobookWebPack1
    HPProductAssistant
    HPSSupply
    InCD
    InCD EasyWrite Reader
    InfraRecorder
    InstallIQ Updater
    iTunes
    Java Auto Updater
    Java(TM) 6 Update 27
    Java(TM) 6 Update 3
    Kobo
    Linksys EasyLink Advisor
    Logitech SetPoint 6.15
    Logitech Vid HD
    Logitech Webcam Software
    Logitech Webcam Software Driver Package
    LSI PCI Soft Modem
    Magical Jelly Bean KeyFinder
    MagicTune
    MailStore Home 5.0.0.6684
    Malwarebytes' Anti-Malware version 1.51.2.1300
    MarketResearch
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Security Update (KB2572067)
    Microsoft .NET Framework 2.0 Service Pack 2
    Microsoft .NET Framework 3.0 Service Pack 2
    Microsoft .NET Framework 3.5 SP1
    Microsoft .NET Framework 4 Client Profile
    Microsoft Application Error Reporting
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.9
    Microsoft Office File Validation Add-In
    Microsoft Office Live Add-in 1.3
    Microsoft Office Professional Edition 2003
    Microsoft PowerPoint Viewer
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
    Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
    Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
    Microsoft Works 4.5
    Microsoft Works Calendar 1.0
    Microsoft Works Setup Launcher
    Miro Video Converter
    MotoHelper MergeModules
    Motorola Mobile Drivers Installation 5.2.0
    Move Media Player
    Mozilla Firefox 8.0 (x86 en-US)
    MSXML 4.0 SP2 (KB954430)
    MSXML 4.0 SP2 (KB973688)
    MSXML 6.0 Parser (KB933579)
    MWSnap 3
    Natural Color
    Nero Media Player
    Nero OEM
    NeroVision Express 2
    NVIDIA Control Panel 280.26
    NVIDIA Display Control Panel
    NVIDIA Graphics Driver 280.26
    NVIDIA Install Application
    NVIDIA nView 135.94
    NVIDIA nView Desktop Manager
    NVIDIA Update 1.4.28
    NVIDIA Update Components
    OCR Software by I.R.I.S. 10.0
    OLYMPUS ib
    OverDrive Media Console
    PanoStandAlone
    PC Tools Spyware Doctor with AntiVirus 9.0
    Peanuts3D FD
    Picasa 3
    PowerDVD
    Pretty Good Solitaire 2k
    PS_AIO_02_ProductContext
    PS_AIO_02_Software
    PS_AIO_02_Software_Min
    PSSWCORE
    Pure Networks Platform
    Quicken 2004
    QuickTime
    Realtek AC'97 Audio
    Roxio Express Labeler 3
    Scan
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft .NET Framework 3.5 SP1 (KB2416473)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
    Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
    Security Update for Windows Internet Explorer 8 (KB2183461)
    Security Update for Windows Internet Explorer 8 (KB2360131)
    Security Update for Windows Internet Explorer 8 (KB2416400)
    Security Update for Windows Internet Explorer 8 (KB2482017)
    Security Update for Windows Internet Explorer 8 (KB2497640)
    Security Update for Windows Internet Explorer 8 (KB2510531)
    Security Update for Windows Internet Explorer 8 (KB2530548)
    Security Update for Windows Internet Explorer 8 (KB2544521)
    Security Update for Windows Internet Explorer 8 (KB2559049)
    Security Update for Windows Internet Explorer 8 (KB2586448)
    Security Update for Windows Internet Explorer 8 (KB971961)
    Security Update for Windows Internet Explorer 8 (KB981332)
    Security Update for Windows Internet Explorer 8 (KB982381)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows XP (KB923789)
    Segoe UI
    Shop for HP Supplies
    Skype™ 5.1
    SmartWebPrintingOC
    SolutionCenter
    Speccy
    SpeedFan (remove only)
    Status
    SUPERAntiSpyware
    swMSM
    Toolbox
    TrayApp
    UnloadSupport
    Update for Microsoft .NET Framework 3.5 SP1 (KB963707)
    Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
    Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
    Update for Windows Internet Explorer 8 (KB2447568)
    Update for Windows Internet Explorer 8 (KB2598845)
    Update for Windows Internet Explorer 8 (KB976662)
    Update for Windows Internet Explorer 8 (KB982632)
    VIA Vinyl Audio Codecs Driver Setup Program
    VideoToolkit01
    WebEx Support Manager for Internet Explorer
    WebFldrs XP
    WebReg
    Windows Driver Package - OLYMPUS IMAGING CORP. Camera Communication Driver Package (09/09/2009 1.0.0.0)
    Windows Genuine Advantage Validation Tool (KB892130)
    Windows Imaging Component
    Windows Internet Explorer 8
    Windows Live Essentials
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Live Writer
    Windows Management Framework Core
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows Media Player Firefox Plugin
    Windows Search 4.0
    Windows XP Service Pack 3
    WinPatrol
    WinZip 14.5
    ZoneAlarm
    ZoneAlarm Free
    ZoneAlarm Toolbar
    Zuma Deluxe
    .
    ==== Event Viewer Messages From Past Week ========
    .
    12/17/2011 9:06:15 AM, error: System Error [1003] - Error code 1000000a, parameter1 c9d6767f, parameter2 00000002, parameter3 00000000, parameter4 804e53cc.
    12/17/2011 9:03:57 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the iPod Service service to connect.
    12/17/2011 9:03:57 AM, error: Service Control Manager [7000] - The iPod Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/17/2011 9:03:56 AM, error: DCOM [10005] - DCOM got error "%1053" attempting to start the service iPod Service with arguments " " in order to run the server: {063D34A4-BF84-4B8D-B699-E8CA06504DDE}
    12/17/2011 9:00:10 AM, error: Service Control Manager [7001] - The Windows Media Player Network Sharing Service service depends on the HTTP SSL service which failed to start because of the following error: The service did not respond to the start or control request in a timely fashion.
    12/17/2011 9:00:10 AM, error: Service Control Manager [7000] - The HTTP SSL service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/17/2011 9:00:09 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the HTTP SSL service to connect.
    12/17/2011 5:16:56 PM, error: Service Control Manager [7000] - The MBAMSwissArmy service failed to start due to the following error: The system cannot find the file specified.
    12/17/2011 3:42:47 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer SALLIE-LAPTOP that believes that it is the master browser for the domain on transport NetBT_Tcpip_{37E3F16E-6217-. The master browser is stopping or an election is being forced.
    12/16/2011 9:54:13 AM, error: BROWSER [8009] - The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is JACK-PC.
    12/16/2011 9:35:13 AM, error: NetBT [4321] - The name "NHOME :1d" could not be registered on the Interface with IP address 192.168.1.100. The machine with the IP address 192.168.1.101 did not allow the name to be claimed by this machine.
    12/16/2011 11:42:29 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service StiSvc with arguments " " in order to run the server: {A1F4E726-8CF1-11D1-BF92-0060081ED811}
    12/16/2011 11:35:02 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service MSIServer with arguments " " in order to run the server: {000C101C-0000-0000-C000-000000000046}
    12/16/2011 11:34:14 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service wuauserv with arguments " " in order to run the server: {E60687F7-01A1-40AA-86AC-DB1CBF673334}
    12/16/2011 11:33:31 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AmdK7 Fips PCTSD SASDIFSV SASKUTIL TfFsMon TFSysMon
    12/15/2011 9:06:44 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the NVSvc service.
    12/15/2011 3:05:00 PM, error: NetBT [4319] - A duplicate name has been detected on the TCP network. The IP address of the machine that sent the message is in the data. Use nbtstat -n in a command window to see which name is in the Conflict state.
    12/15/2011 11:36:58 AM, error: BROWSER [8009] - The browser was unable to promote itself to master browser. The computer that currently believes it is the master browser is SALLIE-LAPTOP.
    12/15/2011 1:08:27 PM, error: BROWSER [8019] - The browser was unable to promote itself to master browser. The browser will continue to attempt to promote itself to the master browser, but will no longer log any events in the event log in Event Viewer.
    12/14/2011 5:19:02 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Akamai service.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD AmdK7 Fips IPSec MRxSmb NetBIOS NetBT pctgntdi PCTSD RasAcd Rdbss SASDIFSV SASKUTIL Tcpip Tcpip6 vsdatant WS2IFSL
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The TrueVector Internet Monitor service depends on the vsdatant service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD Networking Support Environment service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The IPv6 Helper Service service depends on the Microsoft IPv6 Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The IPSEC Services service depends on the IPSEC driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:41 PM, error: Service Control Manager [7001] - The Apple Mobile Device service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
    12/14/2011 4:12:01 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments " " in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
    12/14/2011 4:11:59 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments " " in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
    12/13/2011 4:53:25 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the sdCoreService service.
    12/13/2011 12:05:28 AM, error: NetBT [4321] - The name "NHOME :1d" could not be registered on the Interface with IP address 192.168.1.100. The machine with the IP address 192.168.1.102 did not allow the name to be claimed by this machine.
    12/13/2011 11:57:30 AM, error: Service Control Manager [7022] - The HP CUE DeviceDiscovery Service service hung on starting.
    12/13/2011 11:55:49 AM, error: Service Control Manager [7000] - The mrtRate service failed to start due to the following error: The system cannot find the file specified.
    12/13/2011 10:12:54 AM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the IMAPI CD-Burning COM Service service to connect.
    12/13/2011 10:12:54 AM, error: Service Control Manager [7000] - The IMAPI CD-Burning COM Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/13/2011 10:10:25 AM, error: Service Control Manager [7034] - The Linksys Updater service terminated unexpectedly. It has done this 1 time(s).
    12/13/2011 1:58:45 PM, error: Service Control Manager [7009] - Timeout (30000 milliseconds) waiting for the Windows Media Player Network Sharing Service service to connect.
    12/13/2011 1:58:45 PM, error: Service Control Manager [7000] - The Windows Media Player Network Sharing Service service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
    12/12/2011 9:52:46 PM, error: PCTCore [280] - The item store is corrupted: @5512.
    12/12/2011 9:25:49 AM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: uagp35
    12/12/2011 7:26:04 AM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the Dnscache service.
    12/12/2011 7:19:39 AM, error: W32Time [17] - Time Provider NtpClient: An error occurred during DNS lookup of the manually configured peer 'time.windows.com,0x1'. NtpClient will try the DNS lookup again in 15 minutes. The error was: A socket operation was attempted to an unreachable host. (0x80072751)
    12/12/2011 11:54:51 PM, error: System Error [1003] - Error code 1000008e, parameter1 c0000005, parameter2 80569709, parameter3 b52a8bc4, parameter4 00000000.
    .
    ==== End Of File ===========================
     
    sallnjackn,
    #9
  11. 2011/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good :)

    Let's take care of a rootkit first.

    Download TDSSKiller and save it to your desktop.
    • Doubleclick on TDSSKiller.exe to run the application, then on Start Scan.
    • If an infected file is detected, the default action will be Cure, click on Continue.
    • If a suspicious file is detected, the default action will be Skip, click on Continue.
    • It may ask you to reboot the computer to complete the process. Click on Reboot Now.
    • If no reboot is require, click on Report. A log file should appear. Please copy and paste the contents of that file here.
    • If a reboot is required, the report can also be found in your root directory (usually C:\ folder) in the form of TDSSKiller_xxxx_log.txt. Please copy and paste the contents of that file here.

    When done....
    You're running 3 AV programs, PC Tools Spyware Doctor with AntiVirus, Norton Security Suite and Microsoft Security Essentials.
    You must uninstal TWO of them.
    If Norton is one of them use this tool to uninstall it: https://www-secure.symantec.com/nor...&version=1&pvid=f-home&entsrc=redirect_pubweb
     
    broni,
    #10
  12. 2011/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    You posted all those logs already.
    Please read my previous reply.
     
    broni,
    #11
  13. 2011/12/18
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    Sorry for the delay. I ran TDSSKiller and did cure. The machine froze and the reboot took forever. I have not been able to find the log text by looking or using a search. Should I run it again? I will wait for your answer. Thank you for your patience.
     
    sallnjackn,
    #12
  14. 2011/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    .....
     
    broni,
    #13
  15. 2011/12/18
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    I am running back and forth between my laptop and the xp. Copying everthing to a thumb drive and pasting it over here. I'm sorry I have been so much trouble. It's very confusing going back and forth. I still can't get a browser to work on XP so I have to go between machines.

    20:21:24.0468 6092 TDSS rootkit removing tool 2.6.23.0 Dec 13 2011 10:39:31
    20:21:26.0781 6092 ============================================================
    20:21:26.0781 6092 Current date / time: 2011/12/18 20:21:26.0781
    20:21:26.0781 6092 SystemInfo:
    20:21:26.0781 6092
    20:21:26.0781 6092 OS Version: 5.1.2600 ServicePack: 3.0
    20:21:26.0781 6092 Product type: Workstation
    20:21:26.0781 6092 ComputerName: SALLIE-DESKTOP
    20:21:26.0781 6092 UserName: Sallie
    20:21:26.0781 6092 Windows directory: C:\WINDOWS
    20:21:26.0781 6092 System windows directory: C:\WINDOWS
    20:21:26.0781 6092 Processor architecture: Intel x86
    20:21:26.0781 6092 Number of processors: 1
    20:21:26.0781 6092 Page size: 0x1000
    20:21:26.0781 6092 Boot type: Normal boot
    20:21:26.0781 6092 ============================================================
    20:21:30.0312 6092 Initialize success
    20:21:35.0093 4632 ============================================================
    20:21:35.0093 4632 Scan started
    20:21:35.0093 4632 Mode: Manual;
    20:21:35.0093 4632 ============================================================
    20:21:39.0046 4632 Abiosdsk - ok
    20:21:39.0156 4632 abp480n5 - ok
    20:21:39.0375 4632 ACPI (8fd99680a539792a30e97944fdaecf17) C:\WINDOWS\system32\DRIVERS\ACPI.sys
    20:21:39.0375 4632 ACPI - ok
    20:21:39.0437 4632 ACPIEC (9859c0f6936e723e4892d7141b1327d5) C:\WINDOWS\system32\drivers\ACPIEC.sys
    20:21:39.0468 4632 ACPIEC - ok
    20:21:39.0609 4632 adpu160m - ok
    20:21:39.0718 4632 aec (8bed39e3c35d6a489438b8141717a557) C:\WINDOWS\system32\drivers\aec.sys
    20:21:39.0734 4632 aec - ok
    20:21:39.0890 4632 AFD (1e44bc1e83d8fd2305f8d452db109cf9) C:\WINDOWS\System32\drivers\afd.sys
    20:21:39.0906 4632 AFD - ok
    20:21:40.0062 4632 AgereSoftModem (7560f465f1ce69c53bf17559ee195548) C:\WINDOWS\system32\DRIVERS\AGRSM.sys
    20:21:40.0171 4632 AgereSoftModem - ok
    20:21:40.0218 4632 Aha154x - ok
    20:21:40.0265 4632 aic78u2 - ok
    20:21:40.0328 4632 aic78xx - ok
    20:21:40.0671 4632 ALCXWDM (dd8520280304b6145a6be31008748c7c) C:\WINDOWS\system32\drivers\ALCXWDM.SYS
    20:21:40.0953 4632 ALCXWDM - ok
    20:21:41.0078 4632 AliIde - ok
    20:21:41.0171 4632 AmdK7 (8fce268cdbdd83b23419d1f35f42c7b1) C:\WINDOWS\system32\DRIVERS\amdk7.sys
    20:21:41.0171 4632 AmdK7 - ok
    20:21:41.0234 4632 amsint - ok
    20:21:41.0406 4632 Arp1394 (b5b8a80875c1dededa8b02765642c32f) C:\WINDOWS\system32\DRIVERS\arp1394.sys
    20:21:41.0406 4632 Arp1394 - ok
    20:21:41.0437 4632 asc - ok
    20:21:41.0484 4632 asc3350p - ok
    20:21:41.0546 4632 asc3550 - ok
    20:21:41.0687 4632 AsyncMac (b153affac761e7f5fcfa822b9c4e97bc) C:\WINDOWS\system32\DRIVERS\asyncmac.sys
    20:21:41.0687 4632 AsyncMac - ok
    20:21:41.0781 4632 atapi (9f3a2f5aa6875c72bf062c712cfa2674) C:\WINDOWS\system32\DRIVERS\atapi.sys
    20:21:41.0781 4632 atapi - ok
    20:21:41.0828 4632 Atdisk - ok
    20:21:41.0890 4632 Atmarpc (9916c1225104ba14794209cfa8012159) C:\WINDOWS\system32\DRIVERS\atmarpc.sys
    20:21:41.0906 4632 Atmarpc - ok
    20:21:42.0000 4632 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys
    20:21:42.0000 4632 audstub - ok
    20:21:42.0062 4632 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys
    20:21:42.0078 4632 Beep - ok
    20:21:42.0218 4632 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys
    20:21:42.0234 4632 cbidf2k - ok
    20:21:42.0312 4632 CCDECODE (0be5aef125be881c4f854c554f2b025c) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys
    20:21:42.0312 4632 CCDECODE - ok
    20:21:42.0359 4632 cd20xrnt - ok
    20:21:42.0437 4632 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys
    20:21:42.0437 4632 Cdaudio - ok
    20:21:42.0484 4632 Cdfs (c885b02847f5d2fd45a24e219ed93b32) C:\WINDOWS\system32\drivers\Cdfs.sys
    20:21:42.0484 4632 Cdfs - ok
    20:21:42.0562 4632 Cdrom (7b53584d94e9d8716b2de91d5f1cb42d) C:\WINDOWS\system32\DRIVERS\cdrom.sys
    20:21:42.0562 4632 Cdrom - ok
    20:21:42.0609 4632 Changer - ok
    20:21:42.0734 4632 CmdIde - ok
    20:21:42.0843 4632 Cpqarray - ok
    20:21:42.0921 4632 cpuz132 - ok
    20:21:42.0968 4632 cpuz135 - ok
    20:21:43.0046 4632 dac2w2k - ok
    20:21:43.0093 4632 dac960nt - ok
    20:21:43.0218 4632 Disk (044452051f3e02e7963599fc8f4f3e25) C:\WINDOWS\system32\DRIVERS\disk.sys
    20:21:43.0234 4632 Disk - ok
    20:21:43.0359 4632 dmboot (d992fe1274bde0f84ad826acae022a41) C:\WINDOWS\system32\drivers\dmboot.sys
    20:21:43.0406 4632 dmboot - ok
    20:21:43.0468 4632 dmio (7c824cf7bbde77d95c08005717a95f6f) C:\WINDOWS\system32\drivers\dmio.sys
    20:21:43.0609 4632 dmio - ok
    20:21:43.0640 4632 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys
    20:21:43.0656 4632 dmload - ok
    20:21:43.0765 4632 DMusic (8a208dfcf89792a484e76c40e5f50b45) C:\WINDOWS\system32\drivers\DMusic.sys
    20:21:43.0781 4632 DMusic - ok
    20:21:43.0875 4632 dpti2o - ok
    20:21:43.0921 4632 drmkaud (8f5fcff8e8848afac920905fbd9d33c8) C:\WINDOWS\system32\drivers\drmkaud.sys
    20:21:43.0921 4632 drmkaud - ok
    20:21:44.0062 4632 Fastfat (38d332a6d56af32635675f132548343e) C:\WINDOWS\system32\drivers\Fastfat.sys
    20:21:44.0078 4632 Fastfat - ok
    20:21:44.0187 4632 Fdc (92cdd60b6730b9f50f6a1a0c1f8cdc81) C:\WINDOWS\system32\DRIVERS\fdc.sys
    20:21:44.0187 4632 Fdc - ok
    20:21:44.0265 4632 FETNDIS (e9648254056bce81a85380c0c3647dc4) C:\WINDOWS\system32\DRIVERS\fetnd5.sys
    20:21:44.0281 4632 FETNDIS - ok
    20:21:44.0328 4632 Fips (d45926117eb9fa946a6af572fbe1caa3) C:\WINDOWS\system32\drivers\Fips.sys
    20:21:44.0343 4632 Fips - ok
    20:21:44.0578 4632 Flpydisk (9d27e7b80bfcdf1cdd9b555862d5e7f0) C:\WINDOWS\system32\DRIVERS\flpydisk.sys
    20:21:44.0609 4632 Flpydisk - ok
    20:21:44.0875 4632 FltMgr (b2cf4b0786f8212cb92ed2b50c6db6b0) C:\WINDOWS\system32\drivers\fltmgr.sys
    20:21:45.0546 4632 FltMgr - ok
    20:21:45.0703 4632 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys
    20:21:45.0703 4632 Fs_Rec - ok
    20:21:45.0781 4632 Ftdisk (6ac26732762483366c3969c9e4d2259d) C:\WINDOWS\system32\DRIVERS\ftdisk.sys
    20:21:45.0796 4632 Ftdisk - ok
    20:21:45.0890 4632 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\DRIVERS\GEARAspiWDM.sys
    20:21:45.0906 4632 GEARAspiWDM - ok
    20:21:45.0968 4632 giveio (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys
    20:21:45.0968 4632 giveio - ok
    20:21:46.0015 4632 Gpc (0a02c63c8b144bd8c86b103dee7c86a2) C:\WINDOWS\system32\DRIVERS\msgpc.sys
    20:21:46.0031 4632 Gpc - ok
    20:21:46.0187 4632 hidusb (ccf82c5ec8a7326c3066de870c06daf1) C:\WINDOWS\system32\DRIVERS\hidusb.sys
    20:21:46.0218 4632 hidusb - ok
    20:21:46.0281 4632 hpn - ok
    20:21:46.0390 4632 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys
    20:21:46.0390 4632 HPZid412 - ok
    20:21:46.0734 4632 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys
    20:21:46.0750 4632 HPZipr12 - ok
    20:21:46.0781 4632 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys
    20:21:46.0796 4632 HPZius12 - ok
    20:21:46.0859 4632 HTTP (f80a415ef82cd06ffaf0d971528ead38) C:\WINDOWS\system32\Drivers\HTTP.sys
    20:21:46.0875 4632 HTTP - ok
    20:21:46.0968 4632 i2omgmt - ok
    20:21:46.0984 4632 i2omp - ok
    20:21:47.0062 4632 i8042prt (4a0b06aa8943c1e332520f7440c0aa30) C:\WINDOWS\system32\DRIVERS\i8042prt.sys
    20:21:47.0062 4632 i8042prt - ok
    20:21:47.0156 4632 Imapi (083a052659f5310dd8b6a6cb05edcf8e) C:\WINDOWS\system32\DRIVERS\imapi.sys
    20:21:47.0156 4632 Imapi - ok
    20:21:47.0250 4632 InCDfs (b02356b4fbc840d6225251380ffcab4f) C:\WINDOWS\system32\drivers\InCDfs.sys
    20:21:47.0265 4632 InCDfs - ok
    20:21:47.0328 4632 InCDPass (9b46e27d7c0f57c2b660025df9728d94) C:\WINDOWS\system32\DRIVERS\InCDPass.sys
    20:21:47.0328 4632 InCDPass - ok
    20:21:47.0406 4632 InCDrec (6eb600f5bd8248b28977d4577c11c90e) C:\WINDOWS\system32\drivers\InCDrec.sys
    20:21:47.0406 4632 InCDrec - ok
    20:21:47.0453 4632 incdrm (195a22bc8674090ccce5c3e2b7d96aca) C:\WINDOWS\system32\drivers\incdrm.sys
    20:21:47.0453 4632 incdrm - ok
    20:21:47.0531 4632 ini910u - ok
    20:21:47.0609 4632 IntelIde - ok
    20:21:47.0656 4632 ip6fw (3bb22519a194418d5fec05d800a19ad0) C:\WINDOWS\system32\drivers\ip6fw.sys
    20:21:47.0656 4632 ip6fw - ok
    20:21:47.0734 4632 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys
    20:21:47.0750 4632 IpFilterDriver - ok
    20:21:47.0828 4632 IpInIp (b87ab476dcf76e72010632b5550955f5) C:\WINDOWS\system32\DRIVERS\ipinip.sys
    20:21:47.0828 4632 IpInIp - ok
    20:21:47.0859 4632 IpNat (cc748ea12c6effde940ee98098bf96bb) C:\WINDOWS\system32\DRIVERS\ipnat.sys
    20:21:47.0875 4632 IpNat - ok
    20:21:47.0953 4632 IPSec (23c74d75e36e7158768dd63d92789a91) C:\WINDOWS\system32\DRIVERS\ipsec.sys
    20:21:47.0953 4632 IPSec - ok
    20:21:48.0000 4632 IRENUM (c93c9ff7b04d772627a3646d89f7bf89) C:\WINDOWS\system32\DRIVERS\irenum.sys
    20:21:48.0015 4632 IRENUM - ok
    20:21:48.0109 4632 isapnp (05a299ec56e52649b1cf2fc52d20f2d7) C:\WINDOWS\system32\DRIVERS\isapnp.sys
    20:21:48.0109 4632 isapnp - ok
    20:21:48.0203 4632 ISWKL (eb8594268cf50baaecbe82d70c833533) C:\Program Files\CheckPoint\ZAForceField\ISWKL.sys
    20:21:48.0203 4632 ISWKL - ok
    20:21:48.0281 4632 Kbdclass (463c1ec80cd17420a542b7f36a36f128) C:\WINDOWS\system32\DRIVERS\kbdclass.sys
    20:21:48.0296 4632 Kbdclass - ok
    20:21:48.0343 4632 kbdhid (9ef487a186dea361aa06913a75b3fa99) C:\WINDOWS\system32\DRIVERS\kbdhid.sys
    20:21:48.0343 4632 kbdhid - ok
    20:21:48.0390 4632 kmixer (692bcf44383d056aed41b045a323d378) C:\WINDOWS\system32\drivers\kmixer.sys
    20:21:48.0421 4632 kmixer - ok
    20:21:48.0484 4632 KSecDD (b467646c54cc746128904e1654c750c1) C:\WINDOWS\system32\drivers\KSecDD.sys
    20:21:48.0484 4632 KSecDD - ok
    20:21:48.0593 4632 LBeepKE (ca63fe81705ad660e482bef210bf2c73) C:\WINDOWS\system32\Drivers\LBeepKE.sys
    20:21:48.0609 4632 LBeepKE - ok
    20:21:48.0656 4632 lbrtfdc - ok
    20:21:48.0765 4632 LHidFilt (b68309f25c5787385da842eb5b496958) C:\WINDOWS\system32\DRIVERS\LHidFilt.Sys
    20:21:48.0765 4632 LHidFilt - ok
    20:21:48.0843 4632 libusb0 (b280c4608ac389da9515a35ac4cab0fd) C:\WINDOWS\system32\drivers\libusb0.sys
    20:21:48.0859 4632 libusb0 - ok
    20:21:48.0953 4632 LMouFilt (63d3b1d3cd267fcc186a0146b80d453b) C:\WINDOWS\system32\DRIVERS\LMouFilt.Sys
    20:21:48.0953 4632 LMouFilt - ok
    20:21:49.0046 4632 LVPr2Mon (1a7db7a00a4b0d8da24cd691a4547291) C:\WINDOWS\system32\DRIVERS\LVPr2Mon.sys
    20:21:49.0046 4632 LVPr2Mon - ok
    20:21:49.0156 4632 LVRS (87ecce893d8aec5a9337b917742d339c) C:\WINDOWS\system32\DRIVERS\lvrs.sys
    20:21:49.0171 4632 LVRS - ok
    20:21:49.0250 4632 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys
    20:21:49.0250 4632 mnmdd - ok
    20:21:49.0343 4632 Modem (dfcbad3cec1c5f964962ae10e0bcc8e1) C:\WINDOWS\system32\drivers\Modem.sys
    20:21:49.0359 4632 Modem - ok
    20:21:49.0437 4632 motccgp (f4ea1193a52c8fe4b8a135e210abe546) C:\WINDOWS\system32\DRIVERS\motccgp.sys
    20:21:49.0437 4632 motccgp - ok
    20:21:49.0515 4632 motccgpfl (b812da6605caf02641312f1f65c75419) C:\WINDOWS\system32\DRIVERS\motccgpfl.sys
    20:21:49.0531 4632 motccgpfl - ok
    20:21:49.0578 4632 motmodem (69814acd50a9d6d28296050ef6215d46) C:\WINDOWS\system32\DRIVERS\motmodem.sys
    20:21:49.0578 4632 motmodem - ok
    20:21:49.0625 4632 motport (69814acd50a9d6d28296050ef6215d46) C:\WINDOWS\system32\DRIVERS\motport.sys
    20:21:49.0656 4632 motport - ok
    20:21:49.0703 4632 Mouclass (35c9e97194c8cfb8430125f8dbc34d04) C:\WINDOWS\system32\DRIVERS\mouclass.sys
    20:21:49.0703 4632 Mouclass - ok
    20:21:49.0765 4632 mouhid (b1c303e17fb9d46e87a98e4ba6769685) C:\WINDOWS\system32\DRIVERS\mouhid.sys
    20:21:49.0781 4632 mouhid - ok
    20:21:49.0890 4632 MountMgr (a80b9a0bad1b73637dbcbba7df72d3fd) C:\WINDOWS\system32\drivers\MountMgr.sys
    20:21:49.0906 4632 MountMgr - ok
    20:21:50.0062 4632 MpKsl0625c6cc - ok
    20:21:50.0312 4632 MpKsl234310a4 - ok
    20:21:50.0359 4632 MpKsl321f7044 - ok
    20:21:50.0390 4632 MpKsl6a0c865a - ok
    20:21:50.0437 4632 MpKsla6aa0de4 - ok
    20:21:50.0468 4632 MpKslb79564a4 - ok
    20:21:50.0500 4632 MpKslcccbc33e - ok
    20:21:50.0546 4632 MpKslf53aab93 - ok
    20:21:50.0593 4632 MpKslf9b43df4 - ok
    20:21:50.0640 4632 mraid35x - ok
    20:21:50.0687 4632 mrtRate - ok
    20:21:50.0750 4632 MRxDAV (11d42bb6206f33fbb3ba0288d3ef81bd) C:\WINDOWS\system32\DRIVERS\mrxdav.sys
    20:21:50.0765 4632 MRxDAV - ok
    20:21:50.0843 4632 MRxSmb (7d304a5eb4344ebeeab53a2fe3ffb9f0) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys
    20:21:50.0875 4632 MRxSmb - ok
    20:21:50.0984 4632 Msfs (c941ea2454ba8350021d774daf0f1027) C:\WINDOWS\system32\drivers\Msfs.sys
    20:21:50.0984 4632 Msfs - ok
    20:21:51.0062 4632 MSKSSRV (d1575e71568f4d9e14ca56b7b0453bf1) C:\WINDOWS\system32\drivers\MSKSSRV.sys
    20:21:51.0062 4632 MSKSSRV - ok
    20:21:51.0125 4632 MSPCLOCK (325bb26842fc7ccc1fcce2c457317f3e) C:\WINDOWS\system32\drivers\MSPCLOCK.sys
    20:21:51.0125 4632 MSPCLOCK - ok
    20:21:51.0187 4632 MSPQM (bad59648ba099da4a17680b39730cb3d) C:\WINDOWS\system32\drivers\MSPQM.sys
    20:21:51.0187 4632 MSPQM - ok
    20:21:51.0296 4632 mssmbios (af5f4f3f14a8ea2c26de30f7a1e17136) C:\WINDOWS\system32\DRIVERS\mssmbios.sys
    20:21:51.0296 4632 mssmbios - ok
    20:21:51.0359 4632 MSTEE (e53736a9e30c45fa9e7b5eac55056d1d) C:\WINDOWS\system32\drivers\MSTEE.sys
    20:21:51.0359 4632 MSTEE - ok
    20:21:51.0421 4632 Mup (de6a75f5c270e756c5508d94b6cf68f5) C:\WINDOWS\system32\drivers\Mup.sys
    20:21:51.0437 4632 Mup - ok
    20:21:51.0500 4632 NABTSFEC (5b50f1b2a2ed47d560577b221da734db) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys
    20:21:51.0500 4632 NABTSFEC - ok
    20:21:51.0562 4632 NDIS (1df7f42665c94b825322fae71721130d) C:\WINDOWS\system32\drivers\NDIS.sys
    20:21:51.0578 4632 NDIS - ok
    20:21:51.0625 4632 NdisIP (7ff1f1fd8609c149aa432f95a8163d97) C:\WINDOWS\system32\DRIVERS\NdisIP.sys
    20:21:51.0640 4632 NdisIP - ok
    20:21:51.0718 4632 NdisTapi (0109c4f3850dfbab279542515386ae22) C:\WINDOWS\system32\DRIVERS\ndistapi.sys
    20:21:51.0718 4632 NdisTapi - ok
    20:21:51.0796 4632 Ndisuio (f927a4434c5028758a842943ef1a3849) C:\WINDOWS\system32\DRIVERS\ndisuio.sys
    20:21:51.0812 4632 Ndisuio - ok
    20:21:51.0859 4632 NdisWan (edc1531a49c80614b2cfda43ca8659ab) C:\WINDOWS\system32\DRIVERS\ndiswan.sys
    20:21:51.0859 4632 NdisWan - ok
    20:21:51.0937 4632 NDProxy (9282bd12dfb069d3889eb3fcc1000a9b) C:\WINDOWS\system32\drivers\NDProxy.sys
    20:21:51.0937 4632 NDProxy - ok
    20:21:52.0015 4632 NetBIOS (5d81cf9a2f1a3a756b66cf684911cdf0) C:\WINDOWS\system32\DRIVERS\netbios.sys
    20:21:52.0015 4632 NetBIOS - ok
    20:21:52.0078 4632 NetBT (74b2b2f5bea5e9a3dc021d685551bd3d) C:\WINDOWS\system32\DRIVERS\netbt.sys
    20:21:52.0093 4632 NetBT - ok
    20:21:52.0234 4632 NIC1394 (e9e47cfb2d461fa0fc75b7a74c6383ea) C:\WINDOWS\system32\DRIVERS\nic1394.sys
    20:21:52.0250 4632 NIC1394 - ok
    20:21:52.0328 4632 Npfs (3182d64ae053d6fb034f44b6def8034a) C:\WINDOWS\system32\drivers\Npfs.sys
    20:21:52.0328 4632 Npfs - ok
    20:21:52.0406 4632 Ntfs (78a08dd6a8d65e697c18e1db01c5cdca) C:\WINDOWS\system32\drivers\Ntfs.sys
    20:21:52.0437 4632 Ntfs - ok
    20:21:52.0546 4632 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys
    20:21:52.0546 4632 Null - ok
    20:21:53.0078 4632 nv (6733e80a193fc36f41c24142b0c45c0e) C:\WINDOWS\system32\DRIVERS\nv4_mini.sys
    20:21:53.0640 4632 nv - ok
    20:21:53.0812 4632 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys
    20:21:53.0812 4632 NwlnkFlt - ok
    20:21:53.0890 4632 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys
    20:21:53.0890 4632 NwlnkFwd - ok
    20:21:53.0968 4632 ohci1394 (ca33832df41afb202ee7aeb05145922f) C:\WINDOWS\system32\DRIVERS\ohci1394.sys
    20:21:53.0968 4632 ohci1394 - ok
    20:21:54.0062 4632 Parport (5575faf8f97ce5e713d108c2a58d7c7c) C:\WINDOWS\system32\DRIVERS\parport.sys
    20:21:54.0078 4632 Parport - ok
    20:21:54.0140 4632 PartMgr (beb3ba25197665d82ec7065b724171c6) C:\WINDOWS\system32\drivers\PartMgr.sys
    20:21:54.0140 4632 PartMgr - ok
    20:21:54.0203 4632 ParVdm (70e98b3fd8e963a6a46a2e6247e0bea1) C:\WINDOWS\system32\drivers\ParVdm.sys
    20:21:54.0203 4632 ParVdm - ok
    20:21:54.0265 4632 PCI (a219903ccf74233761d92bef471a07b1) C:\WINDOWS\system32\DRIVERS\pci.sys
    20:21:54.0265 4632 PCI - ok
    20:21:54.0312 4632 PCIDump - ok
    20:21:54.0359 4632 PCIIde - ok
    20:21:54.0421 4632 Pcmcia (9e89ef60e9ee05e3f2eef2da7397f1c1) C:\WINDOWS\system32\drivers\Pcmcia.sys
    20:21:54.0421 4632 Pcmcia - ok
    20:21:54.0468 4632 PCTBD (3a0262b85b5bb4d4cfc096ea00ed610b) C:\WINDOWS\system32\Drivers\PCTBD.sys
    20:21:54.0500 4632 PCTBD - ok
    20:21:54.0625 4632 PCTCore (0edb74bd0d52d6d94cf862322e48b94e) C:\WINDOWS\system32\drivers\PCTCore.sys
    20:21:54.0656 4632 PCTCore - ok
    20:21:54.0734 4632 pctDS (af08ec0f2093867ab955e24121ee7002) C:\WINDOWS\system32\drivers\pctDS.sys
    20:21:54.0765 4632 pctDS - ok
    20:21:54.0890 4632 pctEFA (4b1b0cd45a047c0941f6b6151f6fb3c1) C:\WINDOWS\system32\drivers\pctEFA.sys
    20:21:54.0921 4632 pctEFA - ok
    20:21:55.0031 4632 pctgntdi (44fd6a1042c766df69bc6ba55780019d) C:\WINDOWS\system32\drivers\pctgntdi.sys
    20:21:55.0046 4632 pctgntdi - ok
    20:21:55.0109 4632 pctplsg (b5d22f79943e156bf8fabf1e4888820c) C:\WINDOWS\system32\drivers\pctplsg.sys
    20:21:55.0125 4632 pctplsg - ok
    20:21:55.0171 4632 PCTSD (86b9af53e46d0618d230608aed82622f) C:\WINDOWS\system32\Drivers\PCTSD.sys
    20:21:55.0187 4632 PCTSD - ok
    20:21:55.0250 4632 PDCOMP - ok
    20:21:55.0296 4632 PDFRAME - ok
    20:21:55.0500 4632 PDIHWCTL (274fb48dc92e0ec012d4d8d866cfaf8a) C:\WINDOWS\system32\DRIVERS\PDIHWCTL.SYS
    20:21:55.0531 4632 PDIHWCTL - ok
    20:21:55.0718 4632 PDRELI - ok
    20:21:55.0781 4632 PDRFRAME - ok
    20:21:55.0843 4632 pepifilter (b20f958b207e6aaac5f70d04dd2c30d8) C:\WINDOWS\system32\DRIVERS\lv302af.sys
    20:21:55.0843 4632 pepifilter - ok
    20:21:55.0890 4632 perc2 - ok
    20:21:55.0953 4632 perc2hib - ok
    20:21:56.0171 4632 PID_PEPI (dd184d9adfe2a8a21741dbdfe9e22f5c) C:\WINDOWS\system32\DRIVERS\LV302V32.SYS
    20:21:56.0281 4632 PID_PEPI - ok
    20:21:56.0375 4632 pnarp (dea06627596015263360097c2608384e) C:\WINDOWS\system32\DRIVERS\pnarp.sys
    20:21:56.0375 4632 pnarp - ok
    20:21:56.0500 4632 PptpMiniport (efeec01b1d3cf84f16ddd24d9d9d8f99) C:\WINDOWS\system32\DRIVERS\raspptp.sys
    20:21:56.0515 4632 PptpMiniport - ok
    20:21:56.0593 4632 PSched (09298ec810b07e5d582cb3a3f9255424) C:\WINDOWS\system32\DRIVERS\psched.sys
    20:21:56.0609 4632 PSched - ok
    20:21:56.0671 4632 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys
    20:21:56.0671 4632 Ptilink - ok
    20:21:56.0734 4632 purendis (c0cdb9f7ce42c3487f0bea409bf5d153) C:\WINDOWS\system32\DRIVERS\purendis.sys
    20:21:56.0734 4632 purendis - ok
    20:21:56.0765 4632 ql1080 - ok
    20:21:56.0812 4632 Ql10wnt - ok
    20:21:56.0859 4632 ql12160 - ok
    20:21:56.0921 4632 ql1240 - ok
    20:21:56.0968 4632 ql1280 - ok
    20:21:57.0046 4632 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys
    20:21:57.0062 4632 RasAcd - ok
    20:21:57.0125 4632 Rasl2tp (11b4a627bc9614b885c4969bfa5ff8a6) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys
    20:21:57.0125 4632 Rasl2tp - ok
    20:21:57.0187 4632 RasPppoe (5bc962f2654137c9909c3d4603587dee) C:\WINDOWS\system32\DRIVERS\raspppoe.sys
    20:21:57.0203 4632 RasPppoe - ok
    20:21:57.0250 4632 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys
    20:21:57.0250 4632 Raspti - ok
    20:21:57.0328 4632 Rdbss (7ad224ad1a1437fe28d89cf22b17780a) C:\WINDOWS\system32\DRIVERS\rdbss.sys
    20:21:57.0343 4632 Rdbss - ok
    20:21:57.0406 4632 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys
    20:21:57.0406 4632 RDPCDD - ok
    20:21:57.0468 4632 RDPWD (fc105dd312ed64eb66bff111e8ec6eac) C:\WINDOWS\system32\drivers\RDPWD.sys
    20:21:57.0484 4632 RDPWD - ok
    20:21:57.0562 4632 redbook (f828dd7e1419b6653894a8f97a0094c5) C:\WINDOWS\system32\DRIVERS\redbook.sys
    20:21:57.0578 4632 redbook - ok
    20:21:57.0765 4632 SASDIFSV (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
    20:21:57.0765 4632 SASDIFSV - ok
    20:21:57.0812 4632 SASKUTIL (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
    20:21:57.0828 4632 SASKUTIL - ok
    20:21:57.0984 4632 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys
    20:21:57.0984 4632 Secdrv - ok
    20:21:58.0062 4632 serenum (0f29512ccd6bead730039fb4bd2c85ce) C:\WINDOWS\system32\DRIVERS\serenum.sys
    20:21:58.0062 4632 serenum - ok
    20:21:58.0109 4632 Serial (cca207a8896d4c6a0c9ce29a4ae411a7) C:\WINDOWS\system32\DRIVERS\serial.sys
    20:21:58.0109 4632 Serial - ok
    20:21:58.0281 4632 Sfloppy (8e6b8c671615d126fdc553d1e2de5562) C:\WINDOWS\system32\drivers\Sfloppy.sys
    20:21:58.0281 4632 Sfloppy - ok
    20:21:58.0375 4632 Simbad - ok
    20:21:58.0468 4632 SLIP (866d538ebe33709a5c9f5c62b73b7d14) C:\WINDOWS\system32\DRIVERS\SLIP.sys
    20:21:58.0468 4632 SLIP - ok
    20:21:58.0531 4632 Sparrow - ok
    20:21:58.0609 4632 speedfan (3fa2e254bfbce52b3c6f1bf23aab6911) C:\WINDOWS\system32\speedfan.sys
    20:21:58.0640 4632 speedfan - ok
    20:21:58.0703 4632 splitter (ab8b92451ecb048a4d1de7c3ffcb4a9f) C:\WINDOWS\system32\drivers\splitter.sys
    20:21:58.0703 4632 splitter - ok
    20:21:58.0765 4632 sr (76bb022c2fb6902fd5bdd4f78fc13a5d) C:\WINDOWS\system32\DRIVERS\sr.sys
    20:21:58.0781 4632 sr - ok
    20:21:58.0890 4632 Srv (47ddfc2f003f7f9f0592c6874962a2e7) C:\WINDOWS\system32\DRIVERS\srv.sys
    20:21:58.0937 4632 Srv - ok
    20:21:59.0046 4632 streamip (77813007ba6265c4b6098187e6ed79d2) C:\WINDOWS\system32\DRIVERS\StreamIP.sys
    20:21:59.0046 4632 streamip - ok
    20:21:59.0109 4632 swenum (3941d127aef12e93addf6fe6ee027e0f) C:\WINDOWS\system32\DRIVERS\swenum.sys
    20:21:59.0109 4632 swenum - ok
    20:21:59.0187 4632 swmidi (8ce882bcc6cf8a62f2b2323d95cb3d01) C:\WINDOWS\system32\drivers\swmidi.sys
    20:21:59.0187 4632 swmidi - ok
    20:21:59.0265 4632 symc810 - ok
    20:21:59.0328 4632 symc8xx - ok
    20:21:59.0390 4632 sym_hi - ok
    20:21:59.0437 4632 sym_u3 - ok
    20:21:59.0468 4632 sysaudio (8b83f3ed0f1688b4958f77cd6d2bf290) C:\WINDOWS\system32\drivers\sysaudio.sys
    20:21:59.0484 4632 sysaudio - ok
    20:21:59.0593 4632 Tcpip (9aefa14bd6b182d61e3119fa5f436d3d) C:\WINDOWS\system32\DRIVERS\tcpip.sys
    20:21:59.0609 4632 Tcpip - ok
    20:21:59.0718 4632 Tcpip6 (4e53bbcc4be37d7a4bd6ef1098c89ff7) C:\WINDOWS\system32\DRIVERS\tcpip6.sys
    20:21:59.0734 4632 Tcpip6 - ok
    20:21:59.0796 4632 TDPIPE (6471a66807f5e104e4885f5b67349397) C:\WINDOWS\system32\drivers\TDPIPE.sys
    20:21:59.0812 4632 TDPIPE - ok
    20:21:59.0859 4632 TDTCP (c56b6d0402371cf3700eb322ef3aaf61) C:\WINDOWS\system32\drivers\TDTCP.sys
    20:21:59.0875 4632 TDTCP - ok
    20:21:59.0906 4632 TermDD (88155247177638048422893737429d9e) C:\WINDOWS\system32\DRIVERS\termdd.sys
    20:21:59.0921 4632 TermDD - ok
    20:22:00.0000 4632 TfFsMon (754f8fd78ea7fa2b9a0cb8a69e0f0822) C:\WINDOWS\system32\drivers\TfFsMon.sys
    20:22:00.0015 4632 TfFsMon - ok
    20:22:00.0093 4632 TfNetMon (697f66899b4f0c2d8ae3e7473b4b6244) C:\WINDOWS\system32\drivers\TfNetMon.sys
    20:22:00.0109 4632 TfNetMon - ok
    20:22:00.0250 4632 TFSysMon (e02f47b841be86bfdf4d7269ed0b95e4) C:\WINDOWS\system32\drivers\TfSysMon.sys
    20:22:00.0296 4632 TFSysMon - ok
    20:22:00.0390 4632 TosIde - ok
    20:22:00.0546 4632 tunmp (8f861eda21c05857eb8197300a92501c) C:\WINDOWS\system32\DRIVERS\tunmp.sys
    20:22:00.0578 4632 tunmp - ok
    20:22:00.0640 4632 uagp35 (d85938f272d1bcf3db3a31fc0a048928) C:\WINDOWS\system32\DRIVERS\uagp35.sys
    20:22:00.0656 4632 uagp35 - ok
    20:22:00.0734 4632 Udfs (5787b80c2e3c5e2f56c2a233d91fa2c9) C:\WINDOWS\system32\drivers\Udfs.sys
    20:22:00.0750 4632 Udfs - ok
    20:22:00.0812 4632 ultra - ok
    20:22:00.0890 4632 Update (402ddc88356b1bac0ee3dd1580c76a31) C:\WINDOWS\system32\DRIVERS\update.sys
    20:22:00.0906 4632 Update - ok
    20:22:01.0093 4632 USBAAPL (83cafcb53201bbac04d822f32438e244) C:\WINDOWS\system32\Drivers\usbaapl.sys
    20:22:01.0109 4632 USBAAPL - ok
    20:22:01.0156 4632 usbaudio (e919708db44ed8543a7c017953148330) C:\WINDOWS\system32\drivers\usbaudio.sys
    20:22:01.0171 4632 usbaudio - ok
    20:22:01.0250 4632 usbccgp (173f317ce0db8e21322e71b7e60a27e8) C:\WINDOWS\system32\DRIVERS\usbccgp.sys
    20:22:01.0265 4632 usbccgp - ok
    20:22:01.0312 4632 usbehci (65dcf09d0e37d4c6b11b5b0b76d470a7) C:\WINDOWS\system32\DRIVERS\usbehci.sys
    20:22:01.0328 4632 usbehci - ok
    20:22:01.0375 4632 usbhub (1ab3cdde553b6e064d2e754efe20285c) C:\WINDOWS\system32\DRIVERS\usbhub.sys
    20:22:01.0390 4632 usbhub - ok
    20:22:01.0453 4632 usbprint (a717c8721046828520c9edf31288fc00) C:\WINDOWS\system32\DRIVERS\usbprint.sys
    20:22:01.0453 4632 usbprint - ok
    20:22:01.0515 4632 usbscan (a0b8cf9deb1184fbdd20784a58fa75d4) C:\WINDOWS\system32\DRIVERS\usbscan.sys
    20:22:01.0531 4632 usbscan - ok
    20:22:01.0593 4632 USBSTOR (a32426d9b14a089eaa1d922e0c5801a9) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS
    20:22:01.0609 4632 USBSTOR - ok
    20:22:01.0703 4632 usbuhci (26496f9dee2d787fc3e61ad54821ffe6) C:\WINDOWS\system32\DRIVERS\usbuhci.sys
    20:22:01.0703 4632 usbuhci - ok
    20:22:01.0734 4632 VgaSave (0d3a8fafceacd8b7625cd549757a7df1) C:\WINDOWS\System32\drivers\vga.sys
    20:22:01.0765 4632 VgaSave - ok
    20:22:01.0812 4632 viaagp1 (4b039bbd037b01f5db5a144c837f283a) C:\WINDOWS\system32\DRIVERS\viaagp1.sys
    20:22:01.0828 4632 viaagp1 - ok
    20:22:01.0890 4632 ViaIde (3b3efcda263b8ac14fdf9cbdd0791b2e) C:\WINDOWS\system32\DRIVERS\viaide.sys
    20:22:01.0890 4632 ViaIde - ok
    20:22:01.0953 4632 VIAudio (676418770f7efd7342d19116f4b8911e) C:\WINDOWS\system32\drivers\vinyl97.sys
    20:22:01.0968 4632 VIAudio - ok
    20:22:02.0031 4632 VolSnap (4c8fcb5cc53aab716d810740fe59d025) C:\WINDOWS\system32\drivers\VolSnap.sys
    20:22:02.0031 4632 VolSnap - ok
    20:22:02.0093 4632 vsdatant (050c38ebb22512122e54b47dc278bccd) C:\WINDOWS\system32\vsdatant.sys
    20:22:02.0125 4632 vsdatant - ok
    20:22:02.0265 4632 Wanarp (e20b95baedb550f32dd489265c1da1f6) C:\WINDOWS\system32\DRIVERS\wanarp.sys
    20:22:02.0296 4632 Wanarp - ok
    20:22:02.0406 4632 Wdf01000 (d918617b46457b9ac28027722e30f647) C:\WINDOWS\system32\Drivers\wdf01000.sys
    20:22:02.0421 4632 Wdf01000 - ok
    20:22:02.0468 4632 WDICA - ok
    20:22:02.0531 4632 wdmaud (6768acf64b18196494413695f0c3a00f) C:\WINDOWS\system32\drivers\wdmaud.sys
    20:22:02.0546 4632 wdmaud - ok
    20:22:02.0843 4632 WS2IFSL (6abe6e225adb5a751622a9cc3bc19ce8) C:\WINDOWS\System32\drivers\ws2ifsl.sys
    20:22:02.0859 4632 WS2IFSL - ok
    20:22:02.0968 4632 WSTCODEC (c98b39829c2bbd34e454150633c62c78) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS
    20:22:02.0968 4632 WSTCODEC - ok
    20:22:03.0031 4632 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys
    20:22:03.0046 4632 WudfPf - ok
    20:22:03.0093 4632 WudfRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\wudfrd.sys
    20:22:03.0109 4632 WudfRd - ok
    20:22:03.0265 4632 MBR (0x1B8) (b0b17de2470979f6aa7d36e451109b01) \Device\Harddisk0\DR0
    20:22:03.0265 4632 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - infected
    20:22:03.0265 4632 \Device\Harddisk0\DR0 - detected Rootkit.Boot.Pihar.b (0)
    20:22:03.0328 4632 MBR (0x1B8) (2f7fdae15c4d66f38fb43de22458cc7d) \Device\Harddisk1\DR3
    20:22:03.0328 4632 \Device\Harddisk1\DR3 - ok
    20:22:03.0375 4632 MBR (0x1B8) (e5fa06aca0d60ba9c870d0ef3d9898c9) \Device\Harddisk2\DR4
    20:22:10.0734 4632 \Device\Harddisk2\DR4 - ok
    20:22:10.0750 4632 Boot (0x1200) (98422e90d51561572766bcd3d1b84fc1) \Device\Harddisk0\DR0\Partition0
    20:22:10.0750 4632 \Device\Harddisk0\DR0\Partition0 - ok
    20:22:10.0781 4632 Boot (0x1200) (aa25bd3995d028684e7b1a71a61bfd0b) \Device\Harddisk0\DR0\Partition1
    20:22:10.0796 4632 \Device\Harddisk0\DR0\Partition1 - ok
    20:22:10.0812 4632 Boot (0x1200) (78d5bd8d0f6af96f90eb1a711aff5770) \Device\Harddisk1\DR3\Partition0
    20:22:10.0812 4632 \Device\Harddisk1\DR3\Partition0 - ok
    20:22:10.0843 4632 Boot (0x1200) (ae34c5912c13a026a35aff486632fb1a) \Device\Harddisk1\DR3\Partition1
    20:22:10.0843 4632 \Device\Harddisk1\DR3\Partition1 - ok
    20:22:10.0890 4632 Boot (0x1200) (b892e86d3c2be598c759e06039e91bf3) \Device\Harddisk2\DR4\Partition0
    20:22:10.0890 4632 \Device\Harddisk2\DR4\Partition0 - ok
    20:22:10.0906 4632 ============================================================
    20:22:10.0906 4632 Scan finished
    20:22:10.0906 4632 ============================================================
    20:22:10.0968 3524 Detected object count: 1
    20:22:10.0968 3524 Actual detected object count: 1
    20:23:08.0812 3524 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - will be cured on reboot
    20:23:08.0812 3524 \Device\Harddisk0\DR0 - ok
    20:23:08.0812 3524 \Device\Harddisk0\DR0 ( Rootkit.Boot.Pihar.b ) - User select action: Cure
    20:23:47.0265 5288 Deinitialize success
     
    sallnjackn,
    #14
  16. 2011/12/18
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    XP has a virus

    I am actually on XP with IE. I know it's earlier in California than here. Would it be a problem if I shut dowm my computer for the night and finished up tomorrow? I know I need to so step 5 but it will be easier since I can now work from the sick computer. I won't do anything until I hear from you. Thank you for all your help. Sallie
     
    sallnjackn,
    #15
  17. 2011/12/18
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Good news :)

    Take your time.

    When ready...

    Post fresh aswMBR log.

    Then....

    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    [color= "Blue"]**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**[/color]
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on [color= "Red"]this link[/color] to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE1. If Combofix asks you to install Recovery Console, please allow it.
      NOTE 2. If Combofix asks you to update the program, always do so.
      • Close any open browsers.
      • [color= "Red"]WARNING:[/color] Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt"
    **Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
    **Note 2 for AVG users: ComboFix will not run until AVG is uninstalled as a protective measure against the anti-virus. This is because AVG "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG first.
    Use AppRemover to uninstall it: http://www.appremover.com/
    We can reinstall it when we're done with CF.
    **Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.



    Make sure, you re-enable your security programs, when you're done with Combofix.

    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

    NOTE.
    If, for some reason, Combofix refuses to run, try one of the following:

    1. Run Combofix from Safe Mode (How to...)

    2. Delete Combofix file, download fresh one, but rename combofix.exe to yourname.exe BEFORE saving it to your desktop.
    Do NOT run it yet.

    Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.

    There are 4 different versions. If one of them won't run then download and try to run the other one.

    Vista and Win7 users need to right click Rkill and choose Run as Administrator

    You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

    Rkill.com
    Rkill.scr
    Rkill.exe

    • Double-click on the Rkill desktop icon to run the tool.
    • If using Vista or Windows 7 right-click on it and choose Run As Administrator.
    • A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
    • If not, delete the file, then download and use the one provided in Link 2.
    • If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.
    • Do not reboot until instructed.
    • If the tool does not run from any of the links provided, please let me know.

    Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

    If normal mode still doesn't work, run BOTH tools from safe mode.

    In case #2, please post BOTH logs, rKill and Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!
     
    broni,
    #16
  18. 2011/12/19
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    Windows update keeps asking me to restart my computer. So far I have been able to stop it. Here is aswMBR:
    aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software
    Run date: 2011-12-19 09:57:31
    -----------------------------
    09:57:31.775 OS Version: Windows 5.1.2600 Service Pack 3
    09:57:31.775 Number of processors: 1 586 0x801
    09:57:31.775 ComputerName: SALLIE-DESKTOP UserName: Sallie
    09:57:37.962 Initialize success
    09:57:57.009 AVAST engine defs: 11121801
    09:58:01.572 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
    09:58:01.572 Disk 0 Vendor: WDC_WD5000AAKB-00H8A0 05.04E05 Size: 476940MB BusType: 3
    09:58:03.587 Disk 0 MBR read successfully
    09:58:03.587 Disk 0 MBR scan
    09:58:03.681 Disk 0 Windows XP default MBR code
    09:58:03.697 Disk 0 scanning sectors +976752000
    09:58:03.759 Disk 0 scanning C:\WINDOWS\system32\drivers
    09:59:10.181 Service scanning
    09:59:11.447 Service vsdatant C:\WINDOWS\System32\vsdatant.sys **LOCKED** 32
    09:59:12.025 Modules scanning
    09:59:19.587 Disk 0 trace - called modules:
    09:59:19.619 ntoskrnl.exe CLASSPNP.SYS disk.sys PCTCore.sys ACPI.sys hal.dll atapi.sys viaide.sys PCIIDEX.SYS
    09:59:19.619 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x87315ab8]
    09:59:19.634 3 CLASSPNP.SYS[f7783fd7] -> nt!IofCallDriver -> [0x8732d920]
    09:59:19.650 5 PCTCore.sys[f761a407] -> nt!IofCallDriver -> \Device\00000075[0x87350208]
    09:59:19.650 7 ACPI.sys[f76ba620] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x8731f940]
    09:59:20.494 AVAST engine scan C:\WINDOWS
    09:59:32.978 AVAST engine scan C:\WINDOWS\system32
    10:20:52.681 File: C:\WINDOWS\system32\SET7A.tmp **HIDDEN**
    10:20:53.416 File: C:\WINDOWS\system32\SET7B.tmp **HIDDEN**
    10:20:53.666 File: C:\WINDOWS\system32\_000005_.tmp.dll **HIDDEN**
    10:20:54.900 File: C:\WINDOWS\system32\_000006_.tmp.dll **HIDDEN**
    10:20:57.697 AVAST engine scan C:\WINDOWS\system32\drivers
    10:29:01.791 AVAST engine scan C:\Documents and Settings\Sallie
    11:02:12.369 AVAST engine scan C:\Documents and Settings\All Users
    11:04:22.087 Scan finished successfully
    11:05:06.822 Disk 0 MBR has been saved successfully to "C:\Documents and Settings\Sallie\Desktop\MBR.dat "
    11:05:06.869 The log file has been saved successfully to "C:\Documents and Settings\Sallie\Desktop\aswMBR 12 18.txt "

    I will continue with Combofix.
     
    sallnjackn,
    #17
  19. 2011/12/19
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    ComboFix started running at 12:54 CT. It has ben stalled for about 15 minutes while deleting folders. It deleted 4 folders and now has a blinking cursor but seems stalled. I had to remove Norton with the tool you provided before it could continue but then it ran nicely. I had removed Norton and MSE in add remove programs some time ago but it looks like that didn't get it all. They are not in add/remove anymore. Sallie
     
    sallnjackn,
    #18
  20. 2011/12/19
    sallnjackn

    sallnjackn Well-Known Member Thread Starter

    Joined:
    2005/02/04
    Messages:
    172
    Likes Received:
    0
    Right now XP is not on line. I have BDTUdateService.exe running 97% of my CPU. I understand it is part of PC tools which I purchased recently and am using for my anti virus. When we are done I would like to know what you think is a good product for anti virus. Here iis the combofix text.

    ComboFix 11-12-19.01 - Sallie 12/19/2011 12:56:22.1.1 - x86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1022.446 [GMT -6:00]
    Running from: c:\documents and settings\Sallie\Desktop\ComboFix.exe
    AV: Microsoft Security Essentials *Disabled/Updated* {BCF43643-A118-4432-AEDE-D861FCBCFCDF}
    AV: PC Tools Spyware Doctor with AntiVirus *Disabled/Updated* {D3C23B96-C9DC-477F-8EF1-69AF17A6EFF6}
    FW: ZoneAlarm Firewall *Enabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    c:\documents and settings\All Users\Application Data\TEMP
    c:\documents and settings\All Users\Application Data\TEMP\{89A43E80-AC6C-4DA8-9800-F4B30ED577C0}\PostBuild.exe
    c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\extensions\{a52a1ac3-21d9-44dc-843e-bc647e9185f9}
    c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\extensions\{a52a1ac3-21d9-44dc-843e-bc647e9185f9}\chrome.manifest
    c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\extensions\{a52a1ac3-21d9-44dc-843e-bc647e9185f9}\chrome\xulcache.jar
    c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\extensions\{a52a1ac3-21d9-44dc-843e-bc647e9185f9}\defaults\preferences\xulcache.js
    c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\extensions\{a52a1ac3-21d9-44dc-843e-bc647e9185f9}\install.rdf
    c:\documents and settings\Sallie\mpvfdikvfs.tmp
    c:\documents and settings\Sallie\My Documents\Downloads\PowerPointViewer.exe
    c:\program files\RadioPI_4eEI
    c:\program files\RadioPI_4eEI\Installr\2.bin\4eEIPlug.dll
    c:\program files\RadioPI_4eEI\Installr\2.bin\NP4eEISb.dll
    c:\windows\alcrmv.exe
    c:\windows\system32\0.5021618371150453.exe
    c:\windows\system32\0.6738751965356143.exe
    c:\windows\system32\0.8428795835251978.exe
    c:\windows\system32\0.8949212417061244.exe
    c:\windows\system32\encapi32.dll
    c:\windows\system32\SETB4.tmp
    c:\windows\system32\SETB8.tmp
    c:\windows\system32\SETB9.tmp
    c:\windows\system32\SETC0.tmp
    c:\windows\system32\Thumbs.db
    c:\windows\system32\WINKRNME.DLL
    F:\install.exe
    .
    .
    ((((((((((((((((((((((((( Files Created from 2011-11-19 to 2011-12-19 )))))))))))))))))))))))))))))))
    .
    .
    2103-01-01 05:21 . 2103-01-01 05:21 -------- d-----w- c:\documents and settings\Sallie\Local Settings\Application Data\PCHealth
    2103-01-01 05:21 . 2103-01-01 05:21 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\PCHealth
    2011-12-13 15:35 . 2011-12-13 23:33 -------- d-----w- c:\documents and settings\Sallie\Local Settings\Application Data\ZoneAlarm_Security
    2011-12-13 15:35 . 2011-12-13 15:35 -------- d-----w- c:\program files\ZoneAlarm_Security
    2011-12-13 15:33 . 2011-03-18 07:24 104448 ----a-w- c:\windows\system32\zlcommdb.dll
    2011-12-13 15:33 . 2011-03-18 07:24 69120 ----a-w- c:\windows\system32\zlcomm.dll
    2011-12-13 15:32 . 2011-03-18 07:24 1238528 ----a-w- c:\windows\system32\zpeng25.dll
    2011-12-13 05:11 . 2011-12-13 05:11 -------- d-----w- c:\documents and settings\Sallie\Application Data\CheckPoint
    2011-12-13 04:10 . 2011-12-13 16:06 -------- d-----w- c:\windows\system32\ZoneLabs
    2011-12-13 04:10 . 2011-12-13 04:10 -------- d-----w- c:\program files\Zone Labs
    2011-12-13 04:09 . 2011-12-19 20:14 -------- d-----w- c:\windows\Internet Logs
    2011-12-13 03:58 . 2011-12-13 04:11 -------- d-----w- c:\program files\CheckPoint
    2011-12-09 05:03 . 2011-12-09 05:03 -------- d-----w- c:\documents and settings\Sallie\Local Settings\Application Data\Threat Expert
    2011-12-05 23:30 . 2011-11-23 00:20 574424 --s---w- c:\windows\system32\drivers\TfSysMon.sys
    2011-12-05 23:30 . 2011-11-23 00:20 35264 --s---w- c:\windows\system32\drivers\TfNetMon.sys
    2011-12-05 23:30 . 2011-11-23 00:20 54328 --s---w- c:\windows\system32\drivers\TfFsMon.sys
    2011-12-05 23:14 . 2011-09-28 19:14 56840 ----a-w- c:\windows\system32\drivers\PCTBD.sys
    2011-12-05 23:14 . 2011-11-14 22:07 149456 ----a-w- c:\windows\SGDetectionTool.dll
    2011-12-05 23:14 . 2011-11-14 22:06 767952 ----a-w- c:\windows\BDTSupport.dll
    2011-12-05 23:14 . 2011-11-14 22:07 2246608 ----a-w- c:\windows\PCTBDCore.dll
    2011-12-05 23:14 . 2011-11-14 22:07 1681360 ----a-w- c:\windows\PCTBDRes.dll
    2011-12-05 23:10 . 2011-11-23 01:38 253096 ----a-w- c:\windows\system32\drivers\pctgntdi.sys
    2011-12-05 23:10 . 2011-11-23 01:41 17848 ----a-w- c:\windows\system32\drivers\pctBTFix.sys
    2011-12-05 23:09 . 2011-11-23 01:43 70536 ----a-w- c:\windows\system32\drivers\pctplsg.sys
    2011-12-05 23:09 . 2011-12-05 23:09 -------- d-----w- c:\program files\PC Tools
    2011-12-05 23:06 . 2011-10-07 23:52 660992 ----a-w- c:\windows\system32\drivers\pctEFA.sys
    2011-12-05 23:06 . 2011-10-07 23:52 341656 ----a-w- c:\windows\system32\drivers\pctDS.sys
    2011-12-05 23:06 . 2011-11-14 21:12 331880 ----a-w- c:\windows\system32\drivers\PCTCore.sys
    2011-12-05 23:06 . 2011-11-14 21:12 162584 ----a-w- c:\windows\system32\drivers\PCTAppEvent.sys
    2011-12-05 23:06 . 2011-11-23 01:42 185560 ----a-w- c:\windows\system32\drivers\PCTSD.sys
    2011-12-05 14:38 . 2011-12-05 14:38 -------- d-----w- c:\documents and settings\Sallie\Application Data\TestApp
    2011-12-04 00:15 . 2006-08-01 21:02 49152 ----a-w- c:\windows\system32\ChCfg.exe
    2011-12-04 00:12 . 2008-09-24 16:40 4122368 ----a-r- c:\windows\system32\drivers\alcxwdm.sys
    2011-12-04 00:10 . 2011-12-04 00:10 -------- d-----w- c:\program files\Realtek AC97
    2011-12-04 00:10 . 2006-12-08 21:20 10528768 ----a-w- c:\windows\system32\RTLCPL.exe
    2011-12-04 00:09 . 2007-04-16 21:28 577536 ----a-w- c:\windows\soundman.exe
    2011-12-04 00:09 . 2006-11-17 11:40 18804736 ----a-w- c:\windows\system32\alsndmgr.cpl
    2011-12-04 00:09 . 2006-10-18 08:53 147456 ----a-w- c:\windows\system32\RtlCPAPI.dll
    2011-12-04 00:09 . 2006-07-31 17:19 315392 ----a-w- c:\windows\alcupd.exe
    2011-12-04 00:09 . 2006-02-07 21:40 204800 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iuser.dll
    2011-12-04 00:09 . 2006-02-07 21:40 274432 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iscript.dll
    2011-12-04 00:09 . 2006-02-07 21:40 69715 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\ctor.dll
    2011-12-04 00:09 . 2005-11-14 05:19 5632 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\DotNetInstaller.exe
    2011-12-04 00:09 . 2006-02-07 21:45 757760 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iKernel.dll
    2011-12-04 00:08 . 2011-12-04 00:08 200836 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\iGdi.dll
    2011-12-04 00:08 . 2011-12-04 00:08 331908 ----a-w- c:\program files\Common Files\InstallShield\Professional\RunTime\11\50\Intel32\setup.dll
    2011-12-03 05:14 . 2002-08-29 05:00 84480 -c--a-w- c:\windows\system32\dllcache\ac97via.sys
    2011-12-03 05:14 . 2002-08-29 05:00 84480 ----a-w- c:\windows\system32\drivers\ac97via.sys
    2011-11-27 02:49 . 2011-11-27 02:50 258 ----a-w- C:\cc_20111126_204921.reg
    2011-11-26 03:14 . 2011-11-26 03:14 -------- d-----w- c:\documents and settings\All Users\Application Data\PopCap Games
    2011-11-26 03:13 . 2011-11-26 03:13 -------- d-----w- c:\program files\PopCap Games
    2011-11-26 02:27 . 2011-11-26 02:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Temp
    2011-11-26 02:27 . 2011-11-26 02:27 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
    2011-11-25 01:32 . 2011-11-25 01:35 -------- d-----w- c:\documents and settings\Administrator
    2011-11-25 01:26 . 2011-11-25 01:26 -------- d-----w- c:\documents and settings\Sallie\Application Data\SUPERAntiSpyware.com
    2011-11-25 01:25 . 2011-12-17 05:40 -------- d-----w- c:\program files\SUPERAntiSpyware
    2011-11-25 01:25 . 2011-11-25 01:25 -------- d-----w- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
    2011-11-25 00:25 . 2011-11-25 00:25 1618 ----a-w- C:\cc_20111124_182501.reg
    2011-11-25 00:24 . 2011-11-25 00:24 380492 ----a-w- C:\cc_20111124_182412.reg
    2011-11-23 05:13 . 2011-11-23 05:14 -------- d-----w- c:\program files\SpeedFan
    2011-11-22 00:45 . 2011-11-22 00:47 -------- d-----w- c:\program files\Microsoft
    2011-11-22 00:44 . 2011-11-22 00:46 -------- d-----w- c:\program files\Windows Live
    2011-11-22 00:38 . 2011-03-11 14:10 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll
    2011-11-20 18:19 . 2011-11-20 18:19 -------- d-----w- c:\documents and settings\LocalService\Local Settings\Application Data\Temp
    2011-11-19 20:23 . 2011-11-19 20:23 -------- d-----w- c:\documents and settings\Sallie\Application Data\Malwarebytes
    2011-11-19 20:23 . 2011-11-19 20:23 -------- d-----w- c:\documents and settings\All Users\Application Data\Malwarebytes
    2011-11-19 20:22 . 2011-11-25 03:34 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
    2011-11-19 20:22 . 2011-08-31 23:00 22216 ----a-w- c:\windows\system32\drivers\mbam.sys
    .
    .
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2011-11-23 13:25 . 2010-08-04 03:57 1859584 ----a-w- c:\windows\system32\win32k.sys
    2011-11-14 04:23 . 2011-05-19 03:29 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
    2011-11-04 19:20 . 2006-06-23 16:33 916992 ----a-w- c:\windows\system32\wininet.dll
    2011-11-04 19:20 . 2003-03-31 12:00 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2011-11-04 19:20 . 2003-03-31 12:00 1469440 ----a-w- c:\windows\system32\inetcpl.cpl
    2011-11-04 11:23 . 2004-08-04 05:59 385024 ----a-w- c:\windows\system32\html.iec
    2011-11-01 16:07 . 2005-07-26 04:31 1288704 ----a-w- c:\windows\system32\ole32.dll
    2011-10-28 05:31 . 2010-08-04 03:57 33280 ----a-w- c:\windows\system32\csrsrv.dll
    2011-10-25 13:33 . 2010-08-04 03:57 2192768 ----a-w- c:\windows\system32\ntoskrnl.exe
    2011-10-25 12:52 . 2010-08-04 03:57 2069376 ----a-w- c:\windows\system32\ntkrnlpa.exe
    2011-10-18 11:13 . 2003-03-31 12:00 186880 ----a-w- c:\windows\system32\encdec.dll
    2011-10-10 14:22 . 2010-08-03 20:04 692736 ----a-w- c:\windows\system32\inetcomm.dll
    2011-09-28 07:06 . 2003-03-31 12:00 599040 ----a-w- c:\windows\system32\crypt32.dll
    2011-09-26 16:41 . 2008-07-30 00:59 611328 ----a-w- c:\windows\system32\uiautomationcore.dll
    2011-09-26 16:41 . 2003-03-31 12:00 220160 ----a-w- c:\windows\system32\oleacc.dll
    2011-09-26 16:41 . 2003-03-31 12:00 20480 ----a-w- c:\windows\system32\oleaccrc.dll
    2011-11-09 03:23 . 2011-03-23 23:02 134104 ----a-w- c:\program files\mozilla firefox\components\browsercomps.dll
    .
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546} "= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    2011-05-09 08:49 176936 ----a-w- c:\program files\ZoneAlarm_Security\prxtbZone.dll
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
    "{91da5e8a-3318-4f8c-b67e-5964de3ab546} "= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\Webbrowser]
    "{91DA5E8A-3318-4F8C-B67E-5964DE3AB546} "= "c:\program files\ZoneAlarm_Security\prxtbZone.dll" [2011-05-09 176936]
    .
    [HKEY_CLASSES_ROOT\clsid\{91da5e8a-3318-4f8c-b67e-5964de3ab546}]
    .
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "WMPNSCFG "= "c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-19 204288]
    "SUPERAntiSpyware "= "c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2011-12-17 4616064]
    .
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "HP Software Update "= "c:\program files\HP\HP Software Update\HPWuSchd2.exe" [2007-10-15 49152]
    "hpqSRMon "= "c:\program files\HP\Digital Imaging\bin\hpqSRMon.exe" [2008-08-20 150016]
    "WinPatrol "= "c:\program files\BillP Studios\WinPatrol\winpatrol.exe" [2010-11-17 329096]
    "NvCplDaemon "= "c:\windows\system32\NvCpl.dll" [2011-08-03 13892200]
    "Adobe ARM "= "c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2011-10-09 421736]
    "SoundMan "= "SOUNDMAN.EXE" [2007-04-16 577536]
    "ZoneAlarm Installer "= "c:\program files\CheckPoint\Install\Launcher.exe" [2011-12-19 0]
    "ZoneAlarm Client "= "c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2011-03-18 1043968]
    "ISW "= "c:\program files\CheckPoint\ZAForceField\ForceField.exe" [2011-02-15 738808]
    .
    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "DWQueuedReporting "= "c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-02-26 437160]
    .
    c:\documents and settings\Sallie\Start Menu\Programs\Startup\
    Microsoft Works Calendar Reminders.lnk - f:\program files\msworks calendar\WKCALREM.EXE [1998-7-20 68368]
    .
    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{56F9679E-7826-4C84-81F3-532071A8BCC5} "= "c:\program files\Windows Desktop Search\MSNLNamespaceMgr.dll" [2009-05-25 304128]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2011-07-19 113024]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    2011-05-04 17:54 551296 ----a-w- c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LBTWlgn]
    2010-05-06 09:29 64592 ----a-w- c:\program files\Common Files\logishrd\Bluetooth\LBTWLgn.dll
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
    @=" "
    .
    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @= "Driver "
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring "=dword:00000001
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpiscnapp.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpse.exe "=
    "c:\\Program Files\\Common Files\\HP\\Digital Imaging\\bin\\hpqPhotoCrm.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqsudi.exe "=
    "c:\\Program Files\\HP\\Digital Imaging\\bin\\hpqpsapp.exe "=
    "c:\\Program Files\\Google\\Google Earth\\client\\googleearth.exe "=
    "c:\\Documents and Settings\\Sallie\\Local Settings\\Application Data\\Google\\Google Talk Plugin\\googletalkplugin.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=
    "c:\\Program Files\\Skype\\Plugin Manager\\skypePM.exe "=
    "c:\\Program Files\\7-Zip\\7zFM.exe "=
    "c:\\Program Files\\Fomine Net Send GUI\\NetSendGUI.exe "=
    "c:\\Program Files\\NVIDIA Corporation\\NVIDIA Updatus\\daemonu.exe "=
    "c:\\Program Files\\Common Files\\Apple\\Apple Application Support\\WebKit2WebProcess.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Documents and Settings\\Sallie\\Local Settings\\Application Data\\Akamai\\netsession_win.exe "=
    "c:\\WINDOWS\\system32\\dpvsetup.exe "=
    "c:\\Program Files\\Logitech\\Vid HD\\Vid.exe "=
    "c:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=
    .
    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "67:UDP "= 67:UDP:DHCP Discovery Service
    "5985:TCP "= 5985:TCP:*:Disabled:Windows Remote Management
    "2747:TCP "= 2747:TCP:Akamai NetSession Interface
    "5000:UDP "= 5000:UDP:Akamai NetSession Interface
    .
    R0 PCTCore;PCTools KDS;c:\windows\system32\drivers\PCTCore.sys [12/5/2011 5:06 PM 331880]
    R0 pctDS;PC Tools Data Store;c:\windows\system32\drivers\pctDS.sys [12/5/2011 5:06 PM 341656]
    R0 pctEFA;PC Tools Extended File Attributes;c:\windows\system32\drivers\pctEFA.sys [12/5/2011 5:06 PM 660992]
    R0 TfFsMon;TfFsMon;c:\windows\system32\drivers\TfFsMon.sys [12/5/2011 5:30 PM 54328]
    R0 TFSysMon;TfSysMon;c:\windows\system32\drivers\TfSysMon.sys [12/5/2011 5:30 PM 574424]
    R1 pctgntdi;pctgntdi;c:\windows\system32\drivers\pctgntdi.sys [12/5/2011 5:10 PM 253096]
    R1 PCTSD;PC Tools Spyware Doctor Driver;c:\windows\system32\drivers\PCTSD.sys [12/5/2011 5:06 PM 185560]
    R1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\sasdifsv.sys [7/22/2011 10:27 AM 12880]
    R1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL.SYS [7/12/2011 3:55 PM 67664]
    R2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCore.exe [8/11/2011 5:38 PM 116608]
    R2 Akamai;Akamai NetSession Interface;c:\windows\System32\svchost.exe -k Akamai [3/31/2003 6:00 AM 14336]
    R2 Browser Defender Update Service;Browser Defender Update Service;c:\program files\PC Tools\PC Tools Security\BDT\BDTUpdateService.exe [12/5/2011 5:14 PM 546768]
    R2 ISWKL;ZoneAlarm Toolbar ISWKL;c:\program files\CheckPoint\ZAForceField\ISWKL.sys [2/15/2011 9:25 AM 26872]
    R2 IswSvc;ZoneAlarm Toolbar IswSvc;c:\program files\CheckPoint\ZAForceField\ISWSVC.exe [2/15/2011 9:25 AM 488952]
    R2 LBeepKE;Logitech Beep Suppression Driver;c:\windows\system32\drivers\LBeepKE.sys [8/7/2010 9:30 PM 10448]
    R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe [10/17/2011 8:22 AM 2255464]
    R3 PCTBD;PC Tools Browser Defender Driver;c:\windows\system32\drivers\PCTBD.sys [12/5/2011 5:14 PM 56840]
    S1 MpKsl0625c6cc;MpKsl0625c6cc;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1DD2CBC7-8DDE-461B-8953-2D307F434E08}\MpKsl0625c6cc.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{1DD2CBC7-8DDE-461B-8953-2D307F434E08}\MpKsl0625c6cc.sys [?]
    S1 MpKsl234310a4;MpKsl234310a4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2A52FFA1-B978-4216-9D0A-E54B573DD3FF}\MpKsl234310a4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2A52FFA1-B978-4216-9D0A-E54B573DD3FF}\MpKsl234310a4.sys [?]
    S1 MpKsl321f7044;MpKsl321f7044;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FF067BE6-8296-44FE-8032-0619CDA3788F}\MpKsl321f7044.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{FF067BE6-8296-44FE-8032-0619CDA3788F}\MpKsl321f7044.sys [?]
    S1 MpKsl6a0c865a;MpKsl6a0c865a;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2F0A814-2899-405A-BBEF-91E7605E5889}\MpKsl6a0c865a.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{E2F0A814-2899-405A-BBEF-91E7605E5889}\MpKsl6a0c865a.sys [?]
    S1 MpKsla6aa0de4;MpKsla6aa0de4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{050F2003-90C5-42EA-89B4-7B6A343E4645}\MpKsla6aa0de4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{050F2003-90C5-42EA-89B4-7B6A343E4645}\MpKsla6aa0de4.sys [?]
    S1 MpKslb79564a4;MpKslb79564a4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{65DA83D6-F52C-426F-8DFE-4A6CEE602600}\MpKslb79564a4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{65DA83D6-F52C-426F-8DFE-4A6CEE602600}\MpKslb79564a4.sys [?]
    S1 MpKslcccbc33e;MpKslcccbc33e;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F87185D-E90A-4C89-9D50-916A2D8A0FA0}\MpKslcccbc33e.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{2F87185D-E90A-4C89-9D50-916A2D8A0FA0}\MpKslcccbc33e.sys [?]
    S1 MpKslf53aab93;MpKslf53aab93;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C375D6BF-655A-4B88-897F-D7A98DFDC5F4}\MpKslf53aab93.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C375D6BF-655A-4B88-897F-D7A98DFDC5F4}\MpKslf53aab93.sys [?]
    S1 MpKslf9b43df4;MpKslf9b43df4;\??\c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C4BBF18E-E426-4E44-9037-CCE182730BEF}\MpKslf9b43df4.sys --> c:\documents and settings\All Users\Application Data\Microsoft\Microsoft Antimalware\Definition Updates\{C4BBF18E-E426-4E44-9037-CCE182730BEF}\MpKslf9b43df4.sys [?]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [3/18/2010 1:16 PM 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\Google\Update\GoogleUpdate.exe [11/15/2010 8:49 PM 136176]
    S2 LinksysUpdater;Linksys Updater;c:\program files\Linksys\Linksys Updater\bin\LinksysUpdater.exe [4/18/2008 3:30 AM 204800]
    S2 mrtRate;mrtRate; [x]
    S3 cpuz135;cpuz135;\??\c:\windows\TEMP\cpuz135\cpuz135_x32.sys --> c:\windows\TEMP\cpuz135\cpuz135_x32.sys [?]
    S3 Futuremark SystemInfo Service;Futuremark SystemInfo Service;c:\program files\Common Files\Futuremark Shared\Futuremark SystemInfo\FMSISvc.exe [4/10/2011 3:58 PM 129440]
    S3 gupdatem;Google Update Service (gupdatem);c:\program files\Google\Update\GoogleUpdate.exe [11/15/2010 8:49 PM 136176]
    S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [6/24/2010 4:53 PM 21504]
    S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys [8/21/2008 10:49 PM 20480]
    S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [8/21/2008 10:49 PM 8320]
    S3 motport;Motorola USB Diagnostic Port;c:\windows\system32\drivers\motport.sys [8/8/2011 7:42 PM 24064]
    S3 pctplsg;pctplsg;c:\windows\system32\drivers\pctplsg.sys [12/5/2011 5:09 PM 70536]
    S3 PDIHWCTL;PDIHWCTL;c:\windows\system32\drivers\pdihwctl.sys [1/29/2003 3:08 PM 14416]
    S3 sdAuxService;PC Tools Auxiliary Service;c:\program files\PC Tools\PC Tools Security\pctsAuxs.exe [12/5/2011 5:09 PM 402336]
    S3 TfNetMon;TfNetMon;c:\windows\system32\drivers\TfNetMon.sys [12/5/2011 5:30 PM 35264]
    S3 ThreatFire;ThreatFire;c:\program files\PC Tools\PC Tools Security\TFEngine\TFService.exe service --> c:\program files\PC Tools\PC Tools Security\TFEngine\TFService.exe service [?]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [3/31/2003 6:00 AM 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [3/18/2010 1:16 PM 753504]
    .
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
    HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
    hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
    WINRM REG_MULTI_SZ WINRM
    Akamai REG_MULTI_SZ Akamai
    .
    Contents of the 'Scheduled Tasks' folder
    .
    2011-12-16 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2011-06-01 22:57]
    .
    2011-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-16 02:49]
    .
    2011-12-19 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
    - c:\program files\Google\Update\GoogleUpdate.exe [2010-11-16 02:49]
    .
    2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-573735546-839522115-1004Core.job
    - c:\documents and settings\Sallie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 14:00]
    .
    2011-12-19 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-507921405-573735546-839522115-1004UA.job
    - c:\documents and settings\Sallie\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2011-06-27 14:00]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page =
    uDefault_Search_URL = hxxp://www.google.com/ie
    uInternet Settings,ProxyOverride = 192.168.*.*;*.local
    uSearchAssistant = hxxp://www.google.com/ie
    uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
    IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
    IE: E&xport to Microsoft Excel - f:\progra~1\MICROS~1\OFFICE11\EXCEL.EXE/3000
    LSP: c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    Trusted Zone: microsoft.com\*.update
    Trusted Zone: microsoft.com\www.update
    Trusted Zone: windowsupdate.com\download
    TCP: DhcpNameServer = 75.75.76.76 75.75.75.75 192.168.1.1 75.75.76.76 75.75.75.75
    FF - ProfilePath - c:\documents and settings\Sallie\Application Data\Mozilla\Firefox\Profiles\7ou8f9pk.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2860551&SearchSource=3&q={searchTerms}
    FF - prefs.js: browser.startup.homepage - hxxp://my.earthlink.net/|http://webmail.earthlink.net/wam/index.jsp
    FF - prefs.js: keyword.URL - chrome://browser-region/locale/region.properties
    .
    - - - - ORPHANS REMOVED - - - -
    .
    AddRemove-LSI Soft Modem - c:\windows\agrsmdel
    .
    .
    .
    **************************************************************************
    .
    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2011-12-19 14:14
    Windows 5.1.2600 Service Pack 3 NTFS
    .
    scanning hidden processes ...
    .
    scanning hidden autostart entries ...
    .
    scanning hidden files ...
    .
    scan completed successfully
    hidden files: 0
    .
    **************************************************************************
    .
    [HKEY_LOCAL_MACHINE\System\ControlSet002\Services\Akamai]
    "ServiceDll "= "c:\program files\common files\akamai/netsession_win_b427739.dll "
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------
    .
    [HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]
    @Denied: (2) (LocalSystem)
    "88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,d4,6e,ae,e9,50,8c,41,a5,da,bf,\
    "2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81 "=hex:01,00,00,00,d0,8c,9d,df,01,15,
    d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,d6,d4,6e,ae,e9,50,8c,41,a5,da,bf,\
    .
    [HKEY_USERS\S-1-5-21-507921405-573735546-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------
    .
    - - - - - - - > 'winlogon.exe'(860)
    c:\program files\SUPERAntiSpyware\SASWINLO.DLL
    c:\windows\system32\WININET.dll
    c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll
    c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
    c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.6195_x-ww_44262b86\MSVCR80.dll
    .
    - - - - - - - > 'lsass.exe'(916)
    c:\program files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll
    c:\program files\Common Files\PC Tools\Lsp\PCTLsp.dll
    .
    Completion time: 2011-12-19 14:22:03
    ComboFix-quarantined-files.txt 2011-12-19 20:21
    .
    Pre-Run: 16,816,345,088 bytes free
    Post-Run: 19,120,664,576 bytes free
    .
    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    UnsupportedDebug= "do not select this" /debug
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
    .
    - - End Of File - - 105B8BED14160550AB30A03ACE4113A3
     
    sallnjackn,
    #19
  21. 2011/12/19
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    I still can see two AV programs running, PC Tools Spyware Doctor with AntiVirus and Microsoft Security Essential.
    You must uninstall one of them.
    Your choice.

    Combofix log looks good :)

    Any current issues?

    Download OTL to your Desktop.

    • Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
    • Click the Scan All Users checkbox.
    • Under the Custom Scan box paste this in:


    netsvcs
    drivers32
    %SYSTEMDRIVE%\*.*
    %systemroot%\Fonts\*.com
    %systemroot%\Fonts\*.dll
    %systemroot%\Fonts\*.ini
    %systemroot%\Fonts\*.ini2
    %systemroot%\Fonts\*.exe
    %systemroot%\system32\spool\prtprocs\w32x86\*.*
    %systemroot%\REPAIR\*.bak1
    %systemroot%\REPAIR\*.ini
    %systemroot%\system32\*.jpg
    %systemroot%\*.jpg
    %systemroot%\*.png
    %systemroot%\*.scr
    %systemroot%\*._sy
    %APPDATA%\Adobe\Update\*.*
    %ALLUSERSPROFILE%\Favorites\*.*
    %APPDATA%\Microsoft\*.*
    %PROGRAMFILES%\*.*
    %APPDATA%\Update\*.*
    %systemroot%\*. /mp /s
    CREATERESTOREPOINT
    %systemroot%\System32\config\*.sav
    %PROGRAMFILES%\bak. /s
    %systemroot%\system32\bak. /s
    %ALLUSERSPROFILE%\Start Menu\*.lnk /x
    %systemroot%\system32\config\systemprofile\*.dat /x
    %systemroot%\*.config
    %systemroot%\system32\*.db
    %APPDATA%\Microsoft\Internet Explorer\Quick Launch\*.lnk /x
    %USERPROFILE%\Desktop\*.exe
    %PROGRAMFILES%\Common Files\*.*
    %systemroot%\*.src
    %systemroot%\install\*.*
    %systemroot%\system32\DLL\*.*
    %systemroot%\system32\HelpFiles\*.*
    %systemroot%\system32\rundll\*.*
    %systemroot%\winn32\*.*
    %systemroot%\Java\*.*
    %systemroot%\system32\test\*.*
    %systemroot%\system32\Rundll32\*.*
    %systemroot%\AppPatch\Custom\*.*
    %APPDATA%\Roaming\Microsoft\Windows\Recent\*.lnk /x
    %PROGRAMFILES%\PC-Doctor\Downloads\*.*
    %PROGRAMFILES%\Internet Explorer\*.tmp
    %PROGRAMFILES%\Internet Explorer\*.dat
    %USERPROFILE%\My Documents\*.exe
    %USERPROFILE%\*.exe
    %systemroot%\ADDINS\*.*
    %systemroot%\assembly\*.bak2
    %systemroot%\Config\*.*
    %systemroot%\REPAIR\*.bak2
    %systemroot%\SECURITY\Database\*.sdb /x
    %systemroot%\SYSTEM\*.bak2
    %systemroot%\Web\*.bak2
    %systemroot%\Driver Cache\*.*
    %PROGRAMFILES%\Mozilla Firefox\0*.exe
    %ProgramFiles%\Microsoft Common\*.*
    %ProgramFiles%\TinyProxy.
    %USERPROFILE%\Favorites\*.url /x
    %systemroot%\system32\*.bk
    %systemroot%\*.te
    %systemroot%\system32\system32\*.*
    %ALLUSERSPROFILE%\*.dat /x
    %systemroot%\system32\drivers\*.rmv
    dir /b "%systemroot%\system32\*.exe" | find /i " " /c
    dir /b "%systemroot%\*.exe" | find /i " " /c
    %PROGRAMFILES%\Microsoft\*.*
    %systemroot%\System32\Wbem\proquota.exe
    %PROGRAMFILES%\Mozilla Firefox\*.dat
    %USERPROFILE%\Cookies\*.txt /x
    %SystemRoot%\system32\fonts\*.*
    %systemroot%\system32\winlog\*.*
    %systemroot%\system32\Language\*.*
    %systemroot%\system32\Settings\*.*
    %systemroot%\system32\*.quo
    %SYSTEMROOT%\AppPatch\*.exe
    %SYSTEMROOT%\inf\*.exe
    %SYSTEMROOT%\Installer\*.exe
    %systemroot%\system32\config\*.bak2
    %systemroot%\system32\Computers\*.*
    %SystemRoot%\system32\Sound\*.*
    %SystemRoot%\system32\SpecialImg\*.*
    %SystemRoot%\system32\code\*.*
    %SystemRoot%\system32\draft\*.*
    %SystemRoot%\system32\MSSSys\*.*
    %ProgramFiles%\Javascript\*.*
    %systemroot%\pchealth\helpctr\System\*.exe /s
    %systemroot%\Web\*.exe
    %systemroot%\system32\msn\*.*
    %systemroot%\system32\*.tro
    %AppData%\Microsoft\Installer\msupdates\*.*
    %ProgramFiles%\Messenger\*.*
    %systemroot%\system32\systhem32\*.*
    %systemroot%\system\*.exe
    HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
    /md5start
    /md5stop


    • Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
    • When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
    • Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.
     
    broni,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...