Solved Trojan Zero Access found by McAfee... can you help?

Supawoman · 2012/08/07

[Resolved] Trojan Zero Access found by McAfee... can you help?

Hi There,

A couple of wks or so ago McAfee kept finding Zero Access Trojans that it appeared to not be able to delete.... I've run the applications you asked to be run before posting... sorry it's taken me a couple of weeks to go through them but work and time commitments got in the way... Odd though it may seem, since not using my laptop on a daily basis for a few weeks I don't appear to be getting the trojan messages anymore but get the sneaky feeling they are still there somewhere. Could you please have a look at the posts that follow with the requested info and let me know if you need me to run any more up to date ones... Thanks in advance.

Supawoman · 2012/08/07

By the way, McAfee also found Artemis!

Malwarebytes Anti-Malware log
Malwarebytes Anti-Malware (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.07.12.09

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Rachel Laptop :: RACHLAPTOP-PC [administrator]

Protection: Enabled

12/07/2012 20:10:14
mbam-log-2012-07-12 (20-10-14).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 293962
Time elapsed: 20 minute(s), 1 second(s)

Memory Processes Detected: 1
C:\Users\Rachel Laptop\AppData\Local\Temp\DATDF99.tmp.exe (Trojan.Phex.THAGen1) -> 4928 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 1
HKCU\SOFTWARE\CLASSES\CLSID\{42AEDC87-2188-41FD-B9A3-0C966FEABEC1}\INPROCSERVER32 (Trojan.Zaccess) -> Quarantined and deleted successfully.

Registry Values Detected: 2
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|DATDF99.tmp.exe (Trojan.Phex.THAGen1) -> Data: C:\Users\RACHEL~1\AppData\Local\Temp\DATDF99.tmp.exe -> Quarantined and deleted successfully.
HKCU\SOFTWARE\CLASSES\CLSID\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InprocServer32| (Trojan.Zaccess) -> Data: C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c}\n. -> Quarantined and deleted successfully.

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 2
C:\Users\Rachel Laptop\AppData\Local\Temp\DATDF99.tmp.exe (Trojan.Phex.THAGen1) -> Delete on reboot.
C:\Users\Rachel Laptop\AppData\Local\Temp\17161654.exe (Trojan.Phex.THAGen1) -> Quarantined and deleted successfully.

(end)

Supawoman · 2012/08/07

GMER log - Part 1

GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-13 21:41:55
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.11.0
Running: e90pf28o.exe; Driver: C:\Users\RACHEL~1\AppData\Local\Temp\axdoykoc.sys

---- System - GMER 1.0.15 ----

Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwMapViewOfSection [0x8C1A75A8]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwTerminateProcess [0x8C1A75D2]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwUnmapViewOfSection [0x8C1A75BE]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) ZwYieldExecution [0x8C1A7594]
Code \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.) NtMapViewOfSection

---- Kernel code sections - GMER 1.0.15 ----

.text ntkrnlpa.exe!ZwYieldExecution 83A3D5F5 5 Bytes JMP 8C1A7598 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 83A4F3C9 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 83A88D52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
PAGE ntkrnlpa.exe!NtMapViewOfSection 83C58512 7 Bytes JMP 8C1A75AC \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwTerminateProcess 83C6CBCD 5 Bytes JMP 8C1A75D6 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE ntkrnlpa.exe!ZwUnmapViewOfSection 83C7685A 5 Bytes JMP 8C1A75C2 \SystemRoot\system32\drivers\mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
? C:\Windows\system32\Drivers\rikvm_D20A29D4.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\System32\svchost.exe[352] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 001D000A
.text C:\Windows\System32\svchost.exe[352] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 001D002F
.text C:\Windows\System32\svchost.exe[352] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 001D0FEF
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 001B00D8
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 001B011F
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 001B0F8A
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 001B0FDB
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 001B0098
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 001B0076
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 001B0087
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 001B013A
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 001B0047
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 001B00E9
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 001B0011
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 001B0000
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 001B0FCA
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 001B0FAF
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 001B002C
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 001B0104
.text C:\Windows\System32\svchost.exe[352] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 001B00B3
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!_open 75877E48 5 Bytes JMP 00230FE3
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 0023005D
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!system 758AB177 5 Bytes JMP 00230FD2
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!_creat 758AED31 5 Bytes JMP 0023001D
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00230038
.text C:\Windows\System32\svchost.exe[352] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00230000
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 001C0000
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 001C0F9B
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 001C0F6F
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 001C0F8A
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 001C0011
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 001C002C
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 001C0FC0
.text C:\Windows\System32\svchost.exe[352] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 001C0FDB
.text C:\Windows\System32\svchost.exe[352] WS2_32.dll!socket 75663EB8 5 Bytes JMP 001E0FEF
.text C:\Windows\system32\svchost.exe[356] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\svchost.exe[356] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 003E0FDE
.text C:\Windows\system32\svchost.exe[356] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 003E0014
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 003C0F5E
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 003C0F2B
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 003C0F3C
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 003C0025
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 003C007D
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 003C005B
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 003C006C
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 003C00DB
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 003C0040
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 003C00AC
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 003C0FD4
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 003C0FEF
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 003C0FB9
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 003C0F6F
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 003C000A
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 003C0F4D
.text C:\Windows\system32\svchost.exe[356] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 003C0F8A
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!_open 75877E48 5 Bytes JMP 003F0FEF
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 003F0040
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!system 758AB177 5 Bytes JMP 003F002F
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!_creat 758AED31 5 Bytes JMP 003F0FC6
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 003F0FB5
.text C:\Windows\system32\svchost.exe[356] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 003F0000
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 003D0FEF
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 003D0039
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 003D0FAB
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 003D0FBC
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 003D0FDE
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 003D0F90
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 003D0FCD
.text C:\Windows\system32\svchost.exe[356] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 003D001E
.text C:\Windows\system32\svchost.exe[516] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00910FEF
.text C:\Windows\system32\svchost.exe[516] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 0091001B
.text C:\Windows\system32\svchost.exe[516] ntdll.dll!NtProtectVirtualMemory

Supawoman · 2012/08/07

GMER log - Part 2

.text C:\Windows\system32\svchost.exe[516] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 008B0F1E
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 008B0EC6
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 008B0ED7
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 008B0FAF
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 008B0F5E
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 008B0F79
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 008B0036
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 008B0EAB
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 008B0F94
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 008B0F0D
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 008B0FDB
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 008B0000
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 008B001B
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 008B0051
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 008B0FCA
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 008B0EF2
.text C:\Windows\system32\svchost.exe[516] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 008B0F43
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!_open 75877E48 5 Bytes JMP 00C40000
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00C40040
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!system 758AB177 5 Bytes JMP 00C40FAB
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00C40011
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00C40FBC
.text C:\Windows\system32\svchost.exe[516] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00C40FD7
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 008C0000
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 008C004A
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 008C0FA8
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 008C0FB9
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 008C0FEF
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 008C006F
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 008C0039
.text C:\Windows\system32\svchost.exe[516] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 008C0FDE
.text C:\Windows\system32\svchost.exe[516] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00920000
.text C:\Windows\system32\services.exe[640] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00430000
.text C:\Windows\system32\services.exe[640] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 0043002C
.text C:\Windows\system32\services.exe[640] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00430011
.text C:\Windows\system32\services.exe[640] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 003E0F61
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 003E00CA
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 003E0F3F
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 003E0039
.text C:\Windows\system32\services.exe[640] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 003E0080
.text C:\Windows\system32\services.exe[640] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 003E0FA8
.text C:\Windows\system32\services.exe[640] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 003E006F
.text C:\Windows\system32\services.exe[640] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 003E0F1A
.text C:\Windows\system32\services.exe[640] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 003E0FC3
.text C:\Windows\system32\services.exe[640] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 003E0F50
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 003E0FEF
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 003E000A
.text C:\Windows\system32\services.exe[640] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 003E004A
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 003E0F72
.text C:\Windows\system32\services.exe[640] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 003E0FDE
.text C:\Windows\system32\services.exe[640] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 003E00B9
.text C:\Windows\system32\services.exe[640] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 003E0F8D
.text C:\Windows\system32\services.exe[640] msvcrt.dll!_open 75877E48 5 Bytes JMP 00440000
.text C:\Windows\system32\services.exe[640] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 0044002C
.text C:\Windows\system32\services.exe[640] msvcrt.dll!system 758AB177 5 Bytes JMP 00440FAB
.text C:\Windows\system32\services.exe[640] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00440FD7
.text C:\Windows\system32\services.exe[640] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00440FBC
.text C:\Windows\system32\services.exe[640] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00440011
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 0049000A
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00490047
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00490FB6
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00490058
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00490FEF
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00490069
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00490036
.text C:\Windows\system32\services.exe[640] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00490025
.text C:\Windows\system32\services.exe[640] WS2_32.dll!socket 75663EB8 5 Bytes JMP 004A000A
.text C:\Windows\system32\lsass.exe[656] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00200FEF
.text C:\Windows\system32\lsass.exe[656] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00200FD4
.text C:\Windows\system32\lsass.exe[656] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 0020000A
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 001F0086
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 001F0F0C
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 001F0F1D
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 001F0FBC
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 001F0057
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 001F0F89
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 001F0046
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 001F00BC
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 001F0FAB
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 001F0097
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 001F0FDE
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 001F0FEF
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 001F0F9A
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 001F0F5D
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 001F0FCD
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 001F0F38
.text C:\Windows\system32\lsass.exe[656] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 001F0F6E
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!_open 75877E48 5 Bytes JMP 00220FEF
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00220FAD
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!system 758AB177 5 Bytes JMP 00220038
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00220016
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00220027
.text C:\Windows\system32\lsass.exe[656] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00220FD2
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 006A0FEF
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 006A0FA8
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 006A0040
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 006A0025
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 006A0FDE
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 006A0F83
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 006A0014
.text C:\Windows\system32\lsass.exe[656] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 006A0FB9
.text C:\Windows\system32\lsass.exe[656] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00210FEF
.text C:\Windows\system32\svchost.exe[784] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00300FE5
.text C:\Windows\system32\svchost.exe[784] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 0030000A
.text C:\Windows\system32\svchost.exe[784] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00300FD4
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 002F0F43
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 002F0F0D
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 002F0F28
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 002F0FB9
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 002F0F5E
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 002F0F8A
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 002F0F79
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 002F00BD
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 002F0025
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 002F0087
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 002F000A
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 002F0FEF
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 002F0036
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 002F006C
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 002F0FD4
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 002F00A2
.text C:\Windows\system32\svchost.exe[784] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 002F005B
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_open 75877E48 5 Bytes JMP 00C70FE3
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00C70031
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!system 758AB177 5 Bytes JMP 00C70FA6
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00C70FC1
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00C70016
.text C:\Windows\system32\svchost.exe[784] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00C70FD2
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00D00000
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00D00047
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00D00F9B
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00D00FB6
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00D00011
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00D00062
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00D00FDB
.text C:\Windows\system32\svchost.exe[784] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00D0002C
.text C:\Windows\system32\svchost.exe[784] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00310000
.text C:\Windows\system32\svchost.exe[944] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 002C0FE5
.text C:\Windows\system32\svchost.exe[944] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 002C0FC3
.text C:\Windows\system32\svchost.exe[944] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 002C0FD4
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 002100B0
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00210F4A
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 002100DF
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 0021002C
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00210073
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00210FB6
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00210FA5
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 002100F0
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00210047
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00210F76
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00210011
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00210000
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00210058
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00210095
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00210FDB
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00210F5B
.text C:\Windows\system32\svchost.exe[944] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00210084
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!_open 75877E48 5 Bytes JMP 002E0000
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 002E0053
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!system 758AB177 5 Bytes JMP 002E0038
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!_creat 758AED31 5 Bytes JMP 002E001D
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 002E0FC8
.text C:\Windows\system32\svchost.exe[944] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 002E0FE3
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 002F0FEF
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 002F0FA1
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 002F0F6B
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 002F0F86
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 002F0FD4
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 002F0F50
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 002F0FB2
.text C:\Windows\system32\svchost.exe[944] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 002F0FC3
.text C:\Windows\system32\svchost.exe[944] WS2_32.dll!socket 75663EB8 5 Bytes JMP 002D0FE5
.text C:\Windows\System32\svchost.exe[1000] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00DB0FE5
.text C:\Windows\System32\svchost.exe[1000] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00DB0FD4
.text C:\Windows\System32\svchost.exe[1000] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00DB0000
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00DA0F5B
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00DA00A6
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00DA0095
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00DA0022
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00DA0F91
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00DA0069
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00DA0FA2
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00DA0F00
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00DA003D
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00DA0F40
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00DA0FDB
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00DA0000
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00DA0058
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00DA0F6C
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00DA0011
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00DA0F1B
.text C:\Windows\System32\svchost.exe[1000] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00DA007A
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!_open 75877E48 5 Bytes JMP 00DD0FEF
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00DD0FBC
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!system 758AB177 5 Bytes JMP 00DD003D
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00DD0018
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00DD0FCD
.text C:\Windows\System32\svchost.exe[1000] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00DD0FDE
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00EF0FEF
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00EF0036
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00EF0FAF
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00EF0051
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00EF0000
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00EF0F94
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00EF0025
.text C:\Windows\System32\svchost.exe[1000] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00EF0FCA
.text C:\Windows\System32\svchost.exe[1000] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00DC0FE5
.text C:\Windows\System32\svchost.exe[1108] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00E50000
.text C:\Windows\System32\svchost.exe[1108] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00E5001B
.text C:\Windows\System32\svchost.exe[1108] ntdll.dll!NtProtectVirtualMemory

Supawoman · 2012/08/07

GMER log - Part 3

.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00DC005B
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00DC0EF2
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00DC007D
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00DC0FC0
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00DC0F4D
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00DC0F79
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00DC0F68
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00DC0EE1
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00DC0F9B
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00DC0F17
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00DC0000
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00DC0FE5
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00DC0F8A
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00DC004A
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00DC0011
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00DC006C
.text C:\Windows\System32\svchost.exe[1108] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00DC0F3C
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_open 75877E48 5 Bytes JMP 00EF0FEF
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00EF0F6B
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!system 758AB177 5 Bytes JMP 00EF0F86
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00EF0FAB
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00EF0000
.text C:\Windows\System32\svchost.exe[1108] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00EF0FD2
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00F0000A
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00F00F9E
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00F00036
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00F00025
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00F00FEF
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00F00F79
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00F00FAF
.text C:\Windows\System32\svchost.exe[1108] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00F00FCA
.text C:\Windows\System32\svchost.exe[1108] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00EA0FEF
.text C:\Windows\system32\svchost.exe[1156] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00960FEF
.text C:\Windows\system32\svchost.exe[1156] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00960014
.text C:\Windows\system32\svchost.exe[1156] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00960FDE
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 009500BA
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 009500CB
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00950F36
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00950FDB
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 0095008E
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 0095006C
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExW 757B5079 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 0095007D
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00950F1B
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00950FCA
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00950F6C
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 0095001B
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 0095000A
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00950051
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00950F91
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 0095002C
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00950F51
.text C:\Windows\system32\svchost.exe[1156] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 0095009F
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!_open 75877E48 5 Bytes JMP 009C000C
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 009C0064
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!system 758AB177 5 Bytes JMP 009C0FCF
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!_creat 758AED31 5 Bytes JMP 009C002E
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 009C003F
.text C:\Windows\system32\svchost.exe[1156] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 009C001D
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00CA0000
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00CA0025
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00CA0047
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00CA0036
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00CA0FEF
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00CA0058
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00CA0FB9
.text C:\Windows\system32\svchost.exe[1156] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00CA0FD4
.text C:\Windows\system32\svchost.exe[1156] WS2_32.dll!socket 75663EB8 5 Bytes JMP 009B0FEF
.text C:\Windows\system32\svchost.exe[1316] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00D80000
.text C:\Windows\system32\svchost.exe[1316] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00D80FE5
.text C:\Windows\system32\svchost.exe[1316] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00D8001B
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00C90F65
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00C900D5
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00C900C4
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00C90FCA
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00C9007D
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00C90051
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00C90062
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00C90F1B
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00C90FB9
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00C900B3
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00C9001B
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00C90000
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00C90040
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00C90F80
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00C90FE5
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00C90F54
.text C:\Windows\system32\svchost.exe[1316] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00C9008E
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!_open 75877E48 5 Bytes JMP 00DA0FEF
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00DA0036
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!system 758AB177 5 Bytes JMP 00DA0025
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00DA0FC6
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00DA0FAB
.text C:\Windows\system32\svchost.exe[1316] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00DA0000
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00E30FEF
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00E30039
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00E30F97
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00E30FB2
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00E30FDE
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00E30F7C
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00E30FCD
.text C:\Windows\system32\svchost.exe[1316] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00E30014
.text C:\Windows\system32\svchost.exe[1316] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00D90000
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1408] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 6DC399A1 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe[1408] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 6DC39A63 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text C:\Windows\system32\svchost.exe[1556] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00BC0FE5
.text C:\Windows\system32\svchost.exe[1556] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00BC001B
.text C:\Windows\system32\svchost.exe[1556] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00BC0000
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00BA0F72
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00BA0F32
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00BA00D1
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00BA0040
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00BA0080
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00BA005B
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00BA0FA8
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00BA0F21
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00BA0FD4
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00BA0F61
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00BA0FEF
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00BA000A
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00BA0FB9
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00BA0091
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00BA002F
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!WinExec 757FEDB2 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00BA00B6
.text C:\Windows\system32\svchost.exe[1556] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00BA0F8D
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!_open 75877E48 5 Bytes JMP 00D6000C
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00D60FE5
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!system 758AB177 5 Bytes JMP 00D60070
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00D6003A
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00D6005F
.text C:\Windows\system32\svchost.exe[1556] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00D6001D
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00BB0000
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00BB0FB9
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00BB0040
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00BB0FA8
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00BB0FE5
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00BB0051
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00BB0025
.text C:\Windows\system32\svchost.exe[1556] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00BB0FD4
.text C:\Windows\system32\svchost.exe[1556] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00D1000A
.text C:\Windows\System32\svchost.exe[1712] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040FEF
.text C:\Windows\System32\svchost.exe[1712] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00040011
.text C:\Windows\System32\svchost.exe[1712] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00040000
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 000100BD
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00010F32
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00010F43
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00010036
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 0001007D
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010FA5
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 0001006C
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00010F0D
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010047
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00010F6F
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010FE5
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010000
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010FC0
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 000100A2
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010025
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00010F5E
.text C:\Windows\System32\svchost.exe[1712] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00010F94
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!_open 75877E48 5 Bytes JMP 000E000C
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000E004B
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!system 758AB177 5 Bytes JMP 000E0FC0
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000E0FE5
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000E003A
.text C:\Windows\System32\svchost.exe[1712] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000E001D
.text C:\Windows\System32\svchost.exe[1712] WS2_32.dll!socket 75663EB8 5 Bytes JMP 000F0FEF
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00140000
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 0014002C
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 0014003D
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00140F9B
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00140FDB
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00140058
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 0014001B
.text C:\Windows\System32\svchost.exe[1712] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00140FCA
.text C:\Windows\system32\svchost.exe[1848] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00DF0000
.text C:\Windows\system32\svchost.exe[1848] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00DF0FE5
.text C:\Windows\system32\svchost.exe[1848] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00DF001B
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00D90076
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00D90F03
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00D900A2
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00D90FC0
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00D90040
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00D90F83
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00D90F72
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00D90EF2
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00D90FAF
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00D90087
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00D90FDB
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00D90000
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00D90F9E
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00D9005B
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00D90011
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00D90F28
.text C:\Windows\system32\svchost.exe[1848] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00D90F57
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!_open 75877E48 5 Bytes JMP 00F60FEF
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00F60F9F
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!system 758AB177 5 Bytes JMP 00F60FB0
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00F6000C
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00F60FC1
.text C:\Windows\system32\svchost.exe[1848] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00F60FD2
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00DA0FEF
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00DA004A
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00DA006F
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 00DA0FCD
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00DA0FDE
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00DA0FB2
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00DA002F
.text C:\Windows\system32\svchost.exe[1848] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00DA0014
.text C:\Windows\system32\svchost.exe[1848] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00F50000
.text C:\Windows\System32\svchost.exe[2140] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00380000
.text C:\Windows\System32\svchost.exe[2140] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00380022
.text C:\Windows\System32\svchost.exe[2140] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00380011
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00190F54
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00190F1E
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00190F39
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00190025
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00190F79
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00190040
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00190051
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00190F03
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00190FAF
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00190098
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00190FDE
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00190FEF
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00190F9E
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00190087
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 0019000A
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 001900A9
.text C:\Windows\System32\svchost.exe[2140] kernel32.dll!VirtualProtectEx

Supawoman · 2012/08/07

GMER log - Part 4
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!_open 75877E48 5 Bytes JMP 003B0000
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 003B002C
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!system 758AB177 5 Bytes JMP 003B0FA1
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!_creat 758AED31 5 Bytes JMP 003B0FD7
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 003B0FB2
.text C:\Windows\System32\svchost.exe[2140] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 003B0011
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00370FEF
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00370FB9
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00370FA8
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 0037004A
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 0037000A
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 00370F8D
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 0037001B
.text C:\Windows\System32\svchost.exe[2140] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00370FCA
.text C:\Windows\System32\svchost.exe[2140] WS2_32.dll!socket 75663EB8 5 Bytes JMP 003A0000
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00C40FEF
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00C40FC3
.text C:\Windows\system32\svchost.exe[2200] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00C40FD4
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00450F21
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00450EE8
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00450087
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00450FA8
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00450F72
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 0045002F
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 0045004A
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!GetProcAddress 757BCC94 1 Byte [E9]
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00450098
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00450F97
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 0045005B
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00450FD4
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00450FEF
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00450014
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00450F32
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00450FC3
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00450076
.text C:\Windows\system32\svchost.exe[2200] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00450F4D
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!_open 75877E48 5 Bytes JMP 00C50000
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 00C50FD4
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!system 758AB177 5 Bytes JMP 00C5005F
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!_creat 758AED31 5 Bytes JMP 00C5003A
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 00C50FEF
.text C:\Windows\system32\svchost.exe[2200] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 00C50029
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 004C0FEF
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 004C0FA5
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 004C0F83
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 004C0F94
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 004C0000
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 004C0F68
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 004C0FC0
.text C:\Windows\system32\svchost.exe[2200] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 004C0011
.text C:\Windows\System32\svchost.exe[2464] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040FEF
.text C:\Windows\System32\svchost.exe[2464] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00040FCA
.text C:\Windows\System32\svchost.exe[2464] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00040000
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!GetStartupInfoA 75771E10 1 Byte [E9]
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00010F14
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00010098
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00010F03
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 0001001B
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00010036
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010F79
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00010F5E
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 000100B3
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010FA5
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00010058
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010FE5
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010000
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010F94
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00010F39
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010FCA
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00010073
.text C:\Windows\System32\svchost.exe[2464] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00010047
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!_open 75877E48 5 Bytes JMP 000E000C
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000E0FDE
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!system 758AB177 5 Bytes JMP 000E0FEF
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000E0044
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000E005F
.text C:\Windows\System32\svchost.exe[2464] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000E0029
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 000F0000
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 000F0FC0
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 000F0F9B
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 000F0047
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 000F0FE5
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 000F0058
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 000F002C
.text C:\Windows\System32\svchost.exe[2464] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 000F001B
.text C:\Windows\system32\svchost.exe[3336] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040000
.text C:\Windows\system32\svchost.exe[3336] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 0004001B
.text C:\Windows\system32\svchost.exe[3336] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00040FDB
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00010F5E
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 000100B6
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00010F2B
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00010FD1
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00010F94
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010051
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 0001006C
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 00010F10
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010FC0
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00010F4D
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010011
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010000
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010FAF
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00010087
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010022
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00010F3C
.text C:\Windows\system32\svchost.exe[3336] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00010F79
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!_open 75877E48 5 Bytes JMP 000E0FEF
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000E0F9C
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!system 758AB177 5 Bytes JMP 000E0027
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000E0FD2
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000E0FC1
.text C:\Windows\system32\svchost.exe[3336] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000E000C
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 00100FEF
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 00100FA8
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 00100040
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 0010002F
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 00100FDE
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 0010005B
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 00100014
.text C:\Windows\system32\svchost.exe[3336] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 00100FB9
.text C:\Windows\system32\svchost.exe[3336] WS2_32.dll!socket 75663EB8 5 Bytes JMP 002C0000
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040000
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00040FE5
.text C:\Windows\system32\svchost.exe[3604] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 0004001B
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 0001009B
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00010F32
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 00010F43
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00010FC3
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00010F72
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010043
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00010054
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 000100EC
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010FB2
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 000100AC
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010014
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010FEF
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010F97
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00010080
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010FDE
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 000100BD
.text C:\Windows\system32\svchost.exe[3604] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 0001006F
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_open 75877E48 5 Bytes JMP 000E0000
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000E0FC6
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!system 758AB177 5 Bytes JMP 000E0FD7
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000E0022
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000E0047
.text C:\Windows\system32\svchost.exe[3604] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000E0011
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 000F0000
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 000F0FB9
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 000F0040
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 000F0FA8
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 000F0FE5
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 000F005B
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 000F0FCA
.text C:\Windows\system32\svchost.exe[3604] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 000F0025
.text C:\Windows\system32\svchost.exe[3604] WS2_32.dll!socket 75663EB8 5 Bytes JMP 00190000
.text C:\Windows\Explorer.EXE[3800] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040FEF
.text C:\Windows\Explorer.EXE[3800] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 0004001B
.text C:\Windows\Explorer.EXE[3800] ntdll.dll!NtProtectVirtualMemory 770B5F18 5 Bytes JMP 00040000
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 00010F46
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00010EEB
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 0001008A
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00010FCA
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00010F72
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010F83
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 0001004A
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 0001009B
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010FAF
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 00010F35
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010FDB
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010000
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010F9E
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00010079
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010011
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 00010F10
.text C:\Windows\Explorer.EXE[3800] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00010F61
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 000E000A
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 000E0036
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 000E0F94
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 000E0FA5
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 000E0FE5
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 000E0F83
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 000E0FCA
.text C:\Windows\Explorer.EXE[3800] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 000E001B
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!_open 75877E48 5 Bytes JMP 000F000C
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000F0070
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!system 758AB177 5 Bytes JMP 000F005F
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000F0033
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000F004E
.text C:\Windows\Explorer.EXE[3800] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000F0FEF
.text C:\Windows\Explorer.EXE[3800] WININET.dll!InternetOpenA 75A5D5E8 5 Bytes JMP 00B40000
.text C:\Windows\Explorer.EXE[3800] WININET.dll!InternetOpenUrlA 75A6E1C6 5 Bytes JMP 00B4002F
.text C:\Windows\Explorer.EXE[3800] WININET.dll!InternetOpenW 75A7C596 5 Bytes JMP 00B40FEF
.text C:\Windows\Explorer.EXE[3800] WININET.dll!InternetOpenUrlW 75ACDBF8 5 Bytes JMP 00B40040
.text C:\Windows\Explorer.EXE[3800] WS2_32.dll!socket 75663EB8 5 Bytes JMP 02080000
.text C:\Windows\system32\svchost.exe[7256] ntdll.dll!NtCreateFile 770B55C8 5 Bytes JMP 00040FEF
.text C:\Windows\system32\svchost.exe[7256] ntdll.dll!NtCreateProcess 770B5698 5 Bytes JMP 00040014
.text C:\Windows\system32\svchost.exe[7256] ntdll.dll!NtProtectVirtualMemory

Supawoman · 2012/08/07

GMER log - Part 5
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!GetStartupInfoA 75771E10 5 Bytes JMP 0001009B
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateProcessW 7577204D 5 Bytes JMP 00010F43
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateProcessA 75772082 5 Bytes JMP 000100E2
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateNamedPipeW 757A2D47 5 Bytes JMP 00010025
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!VirtualProtect 757B2BCD 5 Bytes JMP 00010080
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!LoadLibraryExA 757B4466 5 Bytes JMP 00010FB9
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!LoadLibraryExW 757B5079 5 Bytes JMP 00010FA8
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!GetProcAddress 757BCC94 5 Bytes JMP 000100F3
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!LoadLibraryA 757BDC65 5 Bytes JMP 00010040
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!GetStartupInfoW 757BE2DD 5 Bytes JMP 000100B6
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateFileW 757BE8A5 5 Bytes JMP 00010FDE
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateFileA 757BEA61 5 Bytes JMP 00010FEF
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!LoadLibraryW 757BEF42 5 Bytes JMP 00010051
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreatePipe 757D12A6 5 Bytes JMP 00010F72
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!CreateNamedPipeA 757FDBA8 5 Bytes JMP 00010014
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!WinExec 757FEDB2 5 Bytes JMP 000100D1
.text C:\Windows\system32\svchost.exe[7256] kernel32.dll!VirtualProtectEx 757FFD51 5 Bytes JMP 00010F8D
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!_open 75877E48 5 Bytes JMP 000B0FEF
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!_wsystem 758AB057 5 Bytes JMP 000B0F92
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!system 758AB177 5 Bytes JMP 000B001D
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!_creat 758AED31 5 Bytes JMP 000B000C
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!_wcreat 758B0396 5 Bytes JMP 000B0FB7
.text C:\Windows\system32\svchost.exe[7256] msvcrt.dll!_wopen 758B0578 5 Bytes JMP 000B0FD2
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegOpenKeyA 7630CC15 5 Bytes JMP 000C0000
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegCreateKeyA 7630CD01 5 Bytes JMP 000C0FCA
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegCreateKeyExA 76311469 5 Bytes JMP 000C0051
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegCreateKeyW 76311514 5 Bytes JMP 000C0FB9
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegOpenKeyW 76312459 5 Bytes JMP 000C001B
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegCreateKeyExW 763140FE 5 Bytes JMP 000C0062
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegOpenKeyExW 7631468D 5 Bytes JMP 000C0FE5
.text C:\Windows\system32\svchost.exe[7256] ADVAPI32.dll!RegOpenKeyExA 76314907 5 Bytes JMP 000C002C

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[1428] @ C:\Windows\system32\SHELL32.dll [USER32.dll!ExitWindowsEx] [00541210] C:\Program Files\NewTech Infosystems\Acer Backup Manager\Pehook.DLL (Backup Manager Module/NewTech Infosystems, Inc.)
IAT C:\Windows\system32\mfevtps.exe[1824] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [0131A530] C:\Windows\system32\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[2088] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[2088] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[2088] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe[2088] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\system32\rundll32.exe[2360] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\system32\rundll32.exe[2360] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\system32\rundll32.exe[2360] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\system32\rundll32.exe[2360] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73E724CB] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73E5562E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73E556EC] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73E72546] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73E685AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73E64D5E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73E65105] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73E651DA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73E66707] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73E68301] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73E68850] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73E690B1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73E6E254] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73E64C90] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FreeLibraryAndExitThread] [10001E00] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateThread] [10002A00] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)
IAT C:\Windows\Explorer.EXE[3800] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [100011D0] C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (PSD DragDrop Protection/Egis Technology Inc.)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)
IAT C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[7052] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7511FFF6] C:\Windows\system32\apphelp.dll (Application Compatibility Client Library/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \FileSystem\Ntfs \Ntfs MOBK.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

Device \Driver\CLKMDRV10_D20A29D4 \Device\CLRKM#D20A29D4 rikvm_D20A29D4.sys
Device \Driver\ACPI_HAL \Device\0000005d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\fastfat \Fat MOBK.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00265ea58b0e
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00265ea58b0e@2cd2e7bb2aea 0xC6 0xB4 0xEB 0x69 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00265ea58b0e@3017c8527d87 0x47 0xBE 0xBD 0x31 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Upgrade\LocalRadioSettings
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00265ea58b0e (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00265ea58b0e@2cd2e7bb2aea 0xC6 0xB4 0xEB 0x69 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00265ea58b0e@3017c8527d87 0x47 0xBE 0xBD 0x31 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Upgrade\LocalRadioSettings (not active ControlSet)

---- EOF - GMER 1.0.15 ----

Supawoman · 2012/08/07

aswMBR log

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-07-26 18:43:58
-----------------------------
18:43:58.937 OS Version: Windows 6.1.7601 Service Pack 1
18:43:58.937 Number of processors: 2 586 0x170A
18:43:58.941 ComputerName: RACHLAPTOP-PC UserName: Rachel Laptop
18:44:01.117 Initialize success
18:44:13.434 AVAST engine defs: 12072601
18:44:17.188 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
18:44:17.191 Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 3
18:44:17.238 Disk 0 MBR read successfully
18:44:17.241 Disk 0 MBR scan
18:44:17.248 Disk 0 unknown MBR code
18:44:17.275 Disk 0 Partition 1 00 27 Hidden NTFS WinRE MSDOS5.0 10000 MB offset 2048
18:44:17.299 Disk 0 Partition 2 80 (A) 07 HPFS/NTFS NTFS 292171 MB offset 20482048
18:44:17.339 Disk 0 Partition 3 00 12 Compaq diag NTFS 3072 MB offset 618848256
18:44:17.356 Disk 0 scanning sectors +625139712
18:44:17.479 Disk 0 scanning C:\Windows\system32\drivers
18:44:38.112 Service scanning
18:45:23.318 Modules scanning
18:45:39.777 Disk 0 trace - called modules:
18:45:39.804 ntkrnlpa.exe CLASSPNP.SYS disk.sys iaStor.sys halmacpi.dll
18:45:39.811 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8790c030]
18:45:39.821 3 CLASSPNP.SYS[8c5a859e] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x86e9a028]
18:45:41.917 AVAST engine scan C:\Windows
18:45:52.157 AVAST engine scan C:\Windows\system32
18:51:12.375 AVAST engine scan C:\Windows\system32\drivers
18:51:42.726 AVAST engine scan C:\Users\Rachel Laptop
19:23:36.255 AVAST engine scan C:\ProgramData
19:37:11.128 Scan finished successfully
19:53:38.132 Disk 0 MBR has been saved successfully to "C:\Users\Rachel Laptop\Desktop\VIRUS LOGS\MBR.dat "
19:53:38.186 The log file has been saved successfully to "C:\Users\Rachel Laptop\Desktop\VIRUS LOGS\aswMBR.txt "

Supawoman · 2012/08/07

DDS.txt
.
DDS (Ver_2011-08-26.01) - NTFSx86
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.5.1
Run by Rachel Laptop at 20:25:00 on 2012-07-26
Microsoft Windows 7 Ultimate 6.1.7601.1.1252.44.1033.18.3067.1598 [GMT 1:00]
.
AV: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {86355677-4064-3EA7-ABB3-1B136EB04637}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
SP: McAfee Anti-Virus and Anti-Spyware *Enabled/Updated* {3D54B793-665E-3129-9103-206115370C8A}
FW: McAfee Firewall *Enabled* {BE0ED752-0A0B-3FFF-80EC-B2269063014C}
.
============== Running Processes ===============
.
C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k LocalService
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe
C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\system32\svchost.exe -k hpdevmgmt
C:\Program Files\Acer Bio Protection\BASVC.exe
C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe
C:\Windows\system32\mfevtps.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
C:\Windows\System32\svchost.exe -k HPZ12
C:\Program Files\Acer\Acer VCM\RS_Service.exe
C:\Windows\system32\rundll32.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTMon.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files\Common Files\McAfee\SystemCore\mcshield.exe
C:\Program Files\Common Files\McAfee\SystemCore\mfefire.exe
C:\Windows\system32\svchost.exe -k HPService
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Program Files\McAfee Online Backup\MOBKbackup.exe
C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Program Files\McAfee Online Backup\MOBKbackup.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe
C:\Program Files\McAfee Online Backup\MOBKbackup.exe
C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
C:\Program Files\Acer Bio Protection\PdtWzd.exe
C:\Program Files\Apoint2K\Apoint.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\ehome\ehmsas.exe
C:\Program Files\Acer Bio Protection\PwdBank.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\Apoint2K\ApMsgFwd.exe
C:\Program Files\Apoint2K\Apntex.exe
C:\Windows\system32\conhost.exe
C:\Program Files\Apoint2K\HidFind.exe
C:\Program Files\Launch Manager\LManager.exe
C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
C:\Program Files\Saitek\SD6\Software\ProfilerU.exe
C:\Program Files\Saitek\SD6\Software\SaiMfd.exe
C:\Program Files\HP\HP Software Update\hpwuschd2.exe
C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe
C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclMSBTSrvEx.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqbam08.exe
C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
C:\Program Files\HP\Digital Imaging\bin\hpqgpc01.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Windows\system32\SearchIndexer.exe
C:\Program Files\Microsoft Office\Office12\OUTLOOK.EXE
C:\Windows\system32\UI0Detect.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\conhost.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uSearch Page = hxxp://www.google.com
uStart Page = hxxp://www.google.co.uk/
uDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0311&m=aspire_7738
mDefault_Page_URL = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0311&m=aspire_7738
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0809&s=2&o=vp32&d=0311&m=aspire_7738
uSearchURL,(Default) = hxxp://www.google.com/search/?q=%s
uURLSearchHooks: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
BHO: Java(tm) Plug-In SSV Helper: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\oracle\javafx 2.1 runtime\bin\ssv.dll
BHO: scriptproxy: {7db2d5a0-7241-4e79-b68d-6309f01c5231} - c:\program files\common files\mcafee\systemcore\ScriptSn.20120702082613.dll
BHO: McAfee SiteAdvisor BHO: {b164e929-a1b6-4a06-b104-2cd0e90a88ff} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\oracle\javafx 2.1 runtime\bin\jp2ssv.dll
TB: GamesBar: {6f282b65-56bf-4bd1-a8b2-a4449a05863d} - c:\program files\gamesbar\2.0.1.82\oberontb.dll
TB: McAfee SiteAdvisor Toolbar: {0ebbbe48-bad4-4b4c-8e5a-516abecae064} - c:\progra~1\mcafee\sitead~1\mcieplg.dll
TB: {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No File
EB: HP Smart Web Printing: {555d4d79-4bd2-4094-a395-cfc534424a05} - c:\program files\hp\digital imaging\smart web printing\hpswp_bho.dll
uRun: [ProductReg] "c:\program files\acer\wr_popup\ProductReg.exe "
uRun: [EA Core] "c:\program files\electronic arts\eadm\Core.exe" -silent
uRun: [<NO NAME>]
uRun: [NokiaSuite.exe] c:\program files\nokia\nokia suite\NokiaSuite.exe -tray
mRun: [RtHDVCpl] c:\program files\realtek\audio\hda\RtHDVCpl.exe -s
mRun: [Acer ePower Management] c:\program files\acer\acer powersmart manager\ePowerTrayLauncher.exe
mRun: [AmIcoSinglun] c:\program files\amicosinglun\AmIcoSinglun.exe
mRun: [BackupManagerTray] "c:\program files\newtech infosystems\acer backup manager\BackupManagerTray.exe" -k
mRun: [EgisTecLiveUpdate] "c:\program files\egistec egis software update\EgisUpdate.exe "
mRun: [Google Desktop Search] "c:\program files\google\google desktop search\GoogleDesktop.exe" /startup
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe "
mRun: [IAAnotif] c:\program files\intel\intel matrix storage manager\iaanotif.exe
mRun: [mwlDaemon] c:\program files\egistec\mywinlocker 3\x86\mwlDaemon.exe
mRun: [VitaKeyPdtWzd] "c:\program files\acer bio protection\PdtWzd.exe "
mRun: [Apoint] c:\program files\apoint2k\Apoint.exe
mRun: [LManager] c:\program files\launch manager\LManager.exe
mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe "
mRun: [ArcadeDeluxeAgent] "c:\program files\acer arcade deluxe\acer arcade deluxe\ArcadeDeluxeAgent.exe "
mRun: [PlayMovie] "c:\program files\acer arcade deluxe\playmovie\PMVService.exe "
mRun: [ProfilerU] c:\program files\saitek\sd6\software\ProfilerU.exe
mRun: [SaiMfd] c:\program files\saitek\sd6\software\SaiMfd.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [<NO NAME>]
mRun: [mcui_exe] "c:\program files\mcafee.com\agent\mcagent.exe" /runkey
mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe "
mRun: [Reader Application Helper] c:\program files\sony\readerdesktop\apphelper\ReaderAppHelper.exe
mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\blueto~1.lnk - c:\program files\widcomm\bluetooth software\BTTray.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\mcafee~2.lnk - c:\program files\mcafee security scan\2.0.181\SSScheduler.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: ConsentPromptBehaviorAdmin = 5 (0x5)
mPolicies-system: ConsentPromptBehaviorUser = 3 (0x3)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: {10954C80-4F0F-11d3-B17C-00C0DFE39736} - c:\program files\acer bio protection\PwdBank.exe
IE: {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\program files\widcomm\bluetooth software\btsendto_ie.htm
IE: {0000036B-C524-4050-81A0-243669A86B9F} - {B63DBA5F-523F-4B9C-A43D-65DF1977EAD3} - c:\program files\windows live\companion\companioncore.dll
IE: {1A93C934-025B-4c3a-B38E-9654A7003239} - {6F282B65-56BF-4BD1-A8B2-A4449A05863D} - c:\program files\gamesbar\2.0.1.82\oberontb.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~4\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
IE: {DDE87865-83C5-48c4-8357-2F5B1AA84522} - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - c:\program files\hp\digital imaging\smart web printing\hpswp_BHO.dll
Trusted Zone: isvinternet.com\fastpath
DPF: ISVFlashIE2_CabSetup - hxxp://download.isvinternet.com/public/isvflashie2_cabsetup.cab
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
TCP: DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{05651196-655E-4222-BCB2-5BC6592EEF7A} : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{9C4702D7-8ED6-4176-97A6-B75335983DB1} : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{9C4702D7-8ED6-4176-97A6-B75335983DB1}\6796277696E6D65646961673235333330313 : DhcpNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{9C4702D7-8ED6-4176-97A6-B75335983DB1}\6796277696E6D65646961683832313237333 : DhcpNameServer = 194.168.4.100 194.168.8.100
Filter: application/x-mfe-ipt - {3EF5086B-5478-4598-A054-786C45D75692} - c:\progra~1\mcafee\msc\McSnIePl.dll
Handler: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\program files\microsoft office\office12\GrooveSystemServices.dll
Handler: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\progra~1\mcafee\sitead~1\McIEPlg.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\program files\acer\acer vcm\Skype4COM.dll
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - c:\program files\windows live\photo gallery\AlbumDownloadProtocolHandler.dll
AppInit_DLLs: c:\progra~1\google\google~1\GO36F4~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\program files\microsoft office\office12\GrooveShellExtensions.dll
LSA: Notification Packages = c:\program files\acer bio protection\PwdFilter
.
============= SERVICES / DRIVERS ===============
.
R0 mfehidk;McAfee Inc. mfehidk;c:\windows\system32\drivers\mfehidk.sys [2010-10-13 464304]
R0 mfewfpk;McAfee Inc. mfewfpk;c:\windows\system32\drivers\mfewfpk.sys [2012-3-7 169608]
R1 mfenlfk;McAfee NDIS Light Filter;c:\windows\system32\drivers\mfenlfk.sys [2012-3-7 64912]
R1 MOBKFilter;MOBKFilter;c:\windows\system32\drivers\MOBK.sys [2012-3-7 54776]
R1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\drivers\mwlPSDFilter.sys [2008-12-4 19504]
R1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\drivers\mwlPSDNserv.sys [2008-12-4 16432]
R1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\drivers\mwlPSDVDisk.sys [2008-12-4 59952]
R1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\drivers\vwififlt.sys [2009-7-14 48128]
R2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\common files\adobe\arm\1.0\armsvc.exe [2012-1-3 63928]
R2 BecHelperService;BecHelperService;c:\program files\3 mobile broadband\3connect\BecHelperService.exe [2011-4-9 1737464]
R2 ePowerSvc;Acer ePower Service;c:\program files\acer\acer powersmart manager\ePowerSvc.exe [2011-3-28 707104]
R2 FPSensor;EgisTec-Corp Fingerprint Reader Driver (FPSensor.sys);c:\windows\system32\drivers\FPSensor.sys [2011-4-25 29744]
R2 IGBASVC;EgisTec Service;c:\program files\acer bio protection\BASVC.exe [2011-4-25 3450368]
R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2012-7-12 655944]
R2 McAfee SiteAdvisor Service;McAfee SiteAdvisor Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-3-7 214904]
R2 McMPFSvc;McAfee Personal Firewall Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-3-7 214904]
R2 McNaiAnn;McAfee VirusScan Announcer;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-3-7 214904]
R2 McProxy;McAfee Proxy Service;c:\program files\common files\mcafee\mcsvchost\McSvHost.exe [2012-3-7 214904]
R2 McShield;McAfee McShield;c:\program files\common files\mcafee\systemcore\mcshield.exe [2012-3-7 166288]
R2 mfefire;McAfee Firewall Core Service;c:\program files\common files\mcafee\systemcore\mfefire.exe [2012-3-7 161632]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\windows\system32\mfevtps.exe [2011-4-30 151880]
R2 MOBKbackup;McAfee Online Backup;c:\program files\mcafee online backup\MOBKbackup.exe [2010-4-13 229688]
R2 MWLService;MyWinLocker Service;c:\program files\egistec\mywinlocker 3\x86\MWLService.exe [2009-5-14 305448]
R2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files\newtech infosystems\acer backup manager\IScheduleSvc.exe [2009-4-11 61184]
R2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files\newtech infosystems\nti backup now 5\SchedulerSvc.exe [2008-9-23 144632]
R2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files\nvidia corporation\nvidia update core\daemonu.exe [2012-5-23 1262400]
R2 RS_Service;Raw Socket Service;c:\program files\acer\acer vcm\RS_Service.exe [2011-3-28 237568]
R3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [2012-3-7 57600]
R3 hidshim;Service for HID-KMDF Shim layer;c:\windows\system32\drivers\hidshim.sys [2008-10-8 5632]
R3 k57nd60x;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\k57nd60x.sys [2008-9-4 223232]
R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-7-12 22344]
R3 mfeavfk;McAfee Inc. mfeavfk;c:\windows\system32\drivers\mfeavfk.sys [2012-3-7 180848]
R3 mfebopk;McAfee Inc. mfebopk;c:\windows\system32\drivers\mfebopk.sys [2012-3-7 59456]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [2012-3-7 340920]
R3 NETw5s32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 32 Bit;c:\windows\system32\drivers\NETw5s32.sys [2009-9-15 6114816]
R3 nuvotonhidgeneric;Nuvoton EC Generic HID;c:\windows\system32\drivers\nuvotonhidgeneric.sys [2008-10-8 22528]
R3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2012-5-23 148800]
R3 SaiK0CCC;SaiK0CCC;c:\windows\system32\drivers\SaiK0CCC.sys [2011-9-15 138760]
R3 SaiU0CCC;SaiU0CCC;c:\windows\system32\drivers\SaiU0CCC.sys [2011-9-15 35336]
R3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\drivers\vwifimp.sys [2009-7-14 14336]
S2 0250281343317561mcinstcleanup;McAfee Application Installer Cleanup (0250281343317561);c:\windows\temp\025028~1.exe -cleanup -nolog --> c:\windows\temp\025028~1.EXE -cleanup -nolog [?]
S2 CLKMSVC10_D20A29D4;CyberLink Product - 2012/02/23 23:59:56;c:\program files\acer arcade deluxe\playmovie\navfilter\kmsvc.exe [2011-7-3 241648]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2011-3-29 135664]
S3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\macromed\flash\FlashPlayerUpdateService.exe [2012-3-31 250056]
S3 b57nd60x;Broadcom NetXtreme Gigabit Ethernet - NDIS 6.0;c:\windows\system32\drivers\b57nd60x.sys [2009-7-13 229888]
S3 btusbflt;Bluetooth USB Filter;c:\windows\system32\drivers\btusbflt.sys [2010-4-14 45736]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\drivers\btwl2cap.sys [2011-4-23 29472]
S3 fssfltr;fssfltr;c:\windows\system32\drivers\fssfltr.sys [2011-4-24 39272]
S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2010-9-23 1493352]
S3 ggflt;SEMC USB Flash Driver Filter;c:\windows\system32\drivers\ggflt.sys [2012-6-30 13224]
S3 GoogleDesktopManager-051210-111108;Google Desktop Manager 5.9.1005.12335;c:\program files\google\google desktop search\GoogleDesktop.exe [2011-3-28 30192]
S3 gupdatem;Google Update Service (gupdatem);c:\program files\google\update\GoogleUpdate.exe [2011-3-29 135664]
S3 libusb0;libusb-win32 - Kernel Driver, Version 1.2.4.0;c:\windows\system32\drivers\libusb0.sys [2012-3-2 21504]
S3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter.sys [2011-4-9 9216]
S3 McComponentHostService;McAfee Security Scan Component Host Service;c:\program files\mcafee security scan\2.0.181\McCHSvc.exe [2010-1-15 227232]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [2012-3-7 87656]
S3 netw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\drivers\netw5v32.sys [2009-6-10 4231168]
S3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files\newtech infosystems\nti backup now 5\BackupSvc.exe [2008-9-23 50424]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2011-4-25 15872]
S3 SaiH0004;SaiH0004;c:\windows\system32\drivers\SaiH0004.sys [2011-4-23 182528]
S3 SaiL0004;SaiL0004;c:\windows\system32\drivers\SaiL0004.sys [2011-4-23 15104]
S3 SaiU0004;SaiU0004;c:\windows\system32\drivers\SaiU0004.sys [2011-4-23 27392]
S3 Sony PC Companion;Sony PC Companion;c:\program files\sony\sony pc companion\PCCService.exe [2012-3-17 155320]
S3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\TsUsbFlt.sys [2011-4-25 52224]
S3 WatAdminSvc;Windows Activation Technologies Service;c:\windows\system32\wat\WatAdminSvc.exe [2011-4-25 1343400]
S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\wpffontcache_v0400.exe --> c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [?]
S4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\windows live\mesh\wlcrasvc.exe [2010-9-22 51040]
.
=============== Created Last 30 ================
.
2012-07-26 15:57:11 -------- d-----w- c:\program files\Oracle
2012-07-17 07:34:19 4024320 ----a-w- c:\program files\GUT657.tmp
2012-07-17 07:34:19 -------- d-----w- c:\program files\GUM656.tmp
2012-07-12 18:41:18 -------- d-----w- c:\users\rachel laptop\appdata\roaming\Malwarebytes
2012-07-12 18:40:45 -------- d-----w- c:\programdata\Malwarebytes
2012-07-12 18:40:42 22344 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-07-12 18:40:42 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2012-07-12 15:27:03 1838080 ----a-w- c:\users\rachel laptop\appdata\roaming\siw_sdk.dll
2012-07-12 15:26:29 -------- d-----w- c:\program files\SIW
2012-07-10 20:26:06 2345984 ----a-w- c:\windows\system32\win32k.sys
2012-07-02 20:24:39 -------- d-----w- c:\users\rachel laptop\appdata\roaming\calibre
2012-07-02 20:24:15 -------- d-----w- c:\program files\Calibre2
2012-06-30 21:51:30 25512 ----a-w- c:\windows\system32\drivers\ggsemc.sys
2012-06-30 21:51:30 13224 ----a-w- c:\windows\system32\drivers\ggflt.sys
2012-06-30 21:50:36 -------- d-----w- c:\programdata\Sony Ericsson
2012-06-30 21:50:31 -------- d-----w- c:\program files\Sony Ericsson
.
==================== Find3M ====================
.
2012-07-11 20:55:02 70344 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-11 20:55:02 426184 ----a-w- c:\windows\system32\FlashPlayerApp.exe
2012-07-05 21:06:30 772544 ----a-w- c:\windows\system32\npDeployJava1.dll
2012-07-05 21:06:20 687544 ----a-w- c:\windows\system32\deployJava1.dll
2012-06-06 05:05:52 1390080 ----a-w- c:\windows\system32\msxml6.dll
2012-06-06 05:05:52 1236992 ----a-w- c:\windows\system32\msxml3.dll
2012-06-06 05:03:06 805376 ----a-w- c:\windows\system32\cdosys.dll
2012-06-02 22:12:32 2422272 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:12:13 88576 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 14:19:42 171904 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 14:12:20 33792 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 08:33:25 1800192 ----a-w- c:\windows\system32\jscript9.dll
2012-06-02 08:25:08 1129472 ----a-w- c:\windows\system32\wininet.dll
2012-06-02 08:25:03 1427968 ----a-w- c:\windows\system32\inetcpl.cpl
2012-06-02 08:20:33 142848 ----a-w- c:\windows\system32\ieUnatt.exe
2012-06-02 08:16:52 2382848 ----a-w- c:\windows\system32\mshtml.tlb
2012-06-02 04:45:04 67440 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 04:45:03 134000 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 04:40:59 369336 ----a-w- c:\windows\system32\drivers\cng.sys
2012-06-02 04:40:39 225280 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 04:39:10 219136 ----a-w- c:\windows\system32\ncrypt.dll
2012-05-15 10:26:00 883008 ----a-w- c:\windows\system32\nvgenco32.dll
2012-05-15 10:26:00 8105280 ----a-w- c:\windows\system32\nvwgf2um.dll
2012-05-15 10:26:00 61248 ----a-w- c:\windows\system32\OpenCL.dll
2012-05-15 10:26:00 5982528 ----a-w- c:\windows\system32\nvcuda.dll
2012-05-15 10:26:00 2524992 ----a-w- c:\windows\system32\nvcuvid.dll
2012-05-15 10:26:00 2445120 ----a-w- c:\windows\system32\nvcuvenc.dll
2012-05-15 10:26:00 2368832 ----a-w- c:\windows\system32\nvapi.dll
2012-05-15 10:26:00 19607872 ----a-w- c:\windows\system32\nvoglv32.dll
2012-05-15 10:26:00 17551680 ----a-w- c:\windows\system32\nvcompiler.dll
2012-05-15 10:26:00 15322432 ----a-w- c:\windows\system32\nvd3dum.dll
2012-05-15 10:26:00 11354944 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2012-05-15 10:26:00 1000768 ----a-w- c:\windows\system32\nvdispco32.dll
2012-05-15 09:28:50 2561344 ----a-w- c:\windows\system32\nvsvcr.dll
2012-05-15 09:28:49 645440 ----a-w- c:\windows\system32\nvvsvc.exe
2012-05-15 09:28:49 62272 ----a-w- c:\windows\system32\nvshext.dll
2012-05-15 09:28:49 108352 ----a-w- c:\windows\system32\nvmctray.dll
2012-05-15 09:28:48 3931456 ----a-w- c:\windows\system32\nvcpl.dll
2012-05-15 09:27:28 2759488 ----a-w- c:\windows\system32\nvsvc.dll
2012-05-04 09:59:54 514560 ----a-w- c:\windows\system32\qdvd.dll
2012-05-01 04:44:12 164352 ----a-w- c:\windows\system32\profsvc.dll
2012-04-28 04:41:44 919040 ----a-w- c:\windows\system32\rdpcorets.dll
2012-04-28 03:17:07 183808 ----a-w- c:\windows\system32\drivers\rdpwd.sys
.
============= FINISH: 20:31:41.68 ===============

Supawoman · 2012/08/07

Attach.TXT
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2011-08-26.01)
.
Microsoft Windows 7 Ultimate
Boot Device: \Device\HarddiskVolume2
Install Date: 25/04/2011 12:37:13
System Uptime: 26/07/2012 16:37:30 (4 hours ago)
.
Motherboard: Acer | | JM70
Processor: Intel(R) Core(TM)2 Duo CPU T6600 @ 2.20GHz | U2E1 | 2200/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 285 GiB total, 180.504 GiB free.
D: is CDROM ()
.
==== Disabled Device Manager Items =============
.
Class GUID: {4d36e971-e325-11ce-bfc1-08002be10318}
Description: Officejet J6400 series
Device ID: ROOT\MULTIFUNCTION\0000
Manufacturer: HP
Name: Officejet J6400 series
PNP Device ID: ROOT\MULTIFUNCTION\0000
Service:
.
Class GUID: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Description: int15
Device ID: ROOT\LEGACY_INT15\0000
Manufacturer:
Name: int15
PNP Device ID: ROOT\LEGACY_INT15\0000
Service: int15
.
==== System Restore Points ===================
.
RP162: 26/07/2012 16:53:46 - Installed Java(TM) 7 Update 5
RP163: 26/07/2012 16:56:11 - Removed JavaFX 2.1.0
RP164: 26/07/2012 16:56:53 - Installed JavaFX 2.1.1
RP165: 26/07/2012 17:12:55 - Installed Microsoft Office Outlook Connector
.
==== Installed Programs ======================
.
Update for Microsoft Office 2007 (KB2508958)
32 Bit HP CIO Components Installer
3Connect
6400_Help
Acer Arcade Deluxe
Acer Backup Manager
Acer Bio Protection
Acer Crystal Eye Webcam
Acer Crystal Eye webcam Ver:1.1.74.216
Acer eRecovery Management
Acer GridVista
Acer PowerSmart Manager
Acer Product Registration
Acer ScreenSaver
Acer VCM
Acrobat.com
Adobe AIR
Adobe Digital Editions
Adobe Flash Player 11 ActiveX
Adobe Reader X (10.1.3)
Adobe Shockwave Player 11.6
Agere Systems HDA Modem
ALPS Touch Pad Driver
Amazon Kindle
AmIcoSingLun
AVerMedia A309 (MiniCard, DVB-T) 1.0.0.46
AVerMedia A310 (MiniCard, DVB-T) 1.1.0.29
Backup Manager Basic
bpd_scan
BPDSoftware
BPDSoftware_Ini
Broadcom Gigabit NetLink Controller
BufferChm
Burnout(TM) Paradise The Ultimate Box
C:\Program Files\Acer GameZone\GameConsole
calibre
Compatibility Pack for the 2007 Office system
Coupon Printer
CyberLink BD_3D Advisor 2.0
D3DX10
Destinations
DeviceDiscovery
DivX Setup
DocProc
Driving Test Success - All Tests 2012 Edition
Driving Test Success - All Tests 2012 Edition (Update 1)
Driving Test Success ROAD SIGNS
EA SPORTS Gameface Browser Plugin 1.3.1.0
Fax
Fingerprint Solution
Free YouTube to MP3 Converter version 3.10.8.815
Galapago
GamesBar 2.0.1.82
Google Chrome
Google Desktop
Google Update Helper
GPBaseService2
GraphicView 32
Hewlett-Packard ACLM.NET v1.1.0.0
HP Customer Participation Program 13.0
HP Imaging Device Functions 13.0
HP OfficeJet J6400
HP Product Detection
HP Smart Web Printing 4.51
HP Solution Center 13.0
HP Update
HPDiagnosticAlert
HPProductAssistant
HPSSupply
inSSIDer 2.0
Intel® Matrix Storage Manager
J6400
Java Auto Updater
Java(TM) 6 Update 31
Java(TM) 7 Update 5
JavaFX 2.1.1
Jewel Quest Solitaire
Junk Mail filter update
Kobo
Launch Manager
Luxor 2
Mahjong Escape Ancient China
Malwarebytes Anti-Malware version 1.62.0.1300
MarketResearch
McAfee Internet Security
McAfee Online Backup
McAfee Security Scan Plus
Media Go
Mesh Runtime
Messenger Companion
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2007 Service Pack 3 (SP3)
Microsoft Office Access MUI (English) 2007
Microsoft Office Access Setup Metadata MUI (English) 2007
Microsoft Office Communicator 2007
Microsoft Office Enterprise 2007
Microsoft Office Excel MUI (English) 2007
Microsoft Office File Validation Add-In
Microsoft Office Groove MUI (English) 2007
Microsoft Office Groove Setup Metadata MUI (English) 2007
Microsoft Office Home and Student 2007
Microsoft Office InfoPath MUI (English) 2007
Microsoft Office OneNote MUI (English) 2007
Microsoft Office Outlook Connector
Microsoft Office Outlook MUI (English) 2007
Microsoft Office PowerPoint MUI (English) 2007
Microsoft Office PowerPoint Viewer 2007 (English)
Microsoft Office Proof (English) 2007
Microsoft Office Proof (French) 2007
Microsoft Office Proof (Spanish) 2007
Microsoft Office Proofing (English) 2007
Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
Microsoft Office Publisher MUI (English) 2007
Microsoft Office Shared MUI (English) 2007
Microsoft Office Shared Setup Metadata MUI (English) 2007
Microsoft Office Suite Activation Assistant
Microsoft Office Visio Standard 2003
Microsoft Office Word MUI (English) 2007
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable - KB2467175
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
Microsoft Works
Microsoft WSE 3.0 Runtime
Microsoft_VC100_CRT_SP1_x86
MSVC80_x86_v2
MSVC90_x86
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
MyWinLocker
Network
Nokia Connectivity Cable Driver
Nokia Suite
NTI Backup Now 5
NTI Backup Now Standard
NTI Media Maker 8
Nuvoton EC Generic HID Driver
NVIDIA Control Panel 301.42
NVIDIA Graphics Driver 301.42
NVIDIA HD Audio Driver 1.3.16.0
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX System Software 9.12.0213
NVIDIA Update 1.8.15
NVIDIA Update Components
Ocean Express
OCR Software by I.R.I.S. 13.0
OpenAL
Origin
Orion
Parking Dash
PC Connectivity Solution
PlayStation(R)Network Downloader
PlayStation(R)Store
ProductContext
Puzzle Express
Rainbow Web
Reader for PC
Realtek High Definition Audio Driver
Scan
Security Update for CAPICOM (KB931906)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft Office 2007 suites (KB2596666) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596672) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596744) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596785) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596792) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596871) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2596880) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597162) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2597969) 32-Bit Edition
Security Update for Microsoft Office 2007 suites (KB2598041) 32-Bit Edition
Security Update for Microsoft Office Excel 2007 (KB2597161) 32-Bit Edition
Security Update for Microsoft Office InfoPath 2007 (KB2596786) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596764) 32-Bit Edition
Security Update for Microsoft Office PowerPoint 2007 (KB2596912) 32-Bit Edition
Security Update for Microsoft Office Publisher 2007 (KB2596705) 32-Bit Edition
Security Update for Microsoft Office Word 2007 (KB2596917) 32-Bit Edition
Segoe UI
Shop for HP Supplies
SIW version 2011.10.29
Smart Technology Programming Software 7.0.2.7
SmartWebPrinting
SolutionCenter
Sony Ericsson Update Engine
Sony PC Companion 2.10.065
Spelling Dictionaries Support For Adobe Reader 9
Status
swMSM
System Requirements Lab
The Sims 2
The Sims 2 Nightlife
The Sims 2 Open For Business
The Sims 2 Pets
The Sims 2 University
The Sims™ 2 Seasons
The Sims™ 3
The Sims™ 3 Ambitions
The Sims™ 3 Create a Pattern Tool
The Sims™ 3 Generations
The Sims™ 3 Late Night
The Sims™ 3 Pets
The Sims™ 3 World Adventures
Toolbox
Tradewinds 2
TrayApp
Tri-Peaks Solitaire To Go
Turbo Pizza
Unity Web Player
Update for 2007 Microsoft Office System (KB967642)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft Office 2007 Help for Common Features (KB963673)
Update for Microsoft Office Access 2007 Help (KB963663)
Update for Microsoft Office Excel 2007 Help (KB963678)
Update for Microsoft Office Infopath 2007 Help (KB963662)
Update for Microsoft Office OneNote 2007 Help (KB963670)
Update for Microsoft Office Outlook 2007 (KB2596598) 32-Bit Edition
Update for Microsoft Office Outlook 2007 Help (KB963677)
Update for Microsoft Office Outlook 2007 Junk Email Filter (KB2687310) 32-Bit Edition
Update for Microsoft Office Powerpoint 2007 Help (KB963669)
Update for Microsoft Office Publisher 2007 Help (KB963667)
Update for Microsoft Office Script Editor Help (KB963671)
Update for Microsoft Office Word 2007 Help (KB963665)
VC80CRTRedist - 8.0.50727.6195
WebReg
Wedding Dash
WIDCOMM Bluetooth Software
Windows 7 Upgrade Advisor
Windows Driver Package - Nokia pccsmcfd (08/22/2008 7.0.0.0)
Windows Live Communications Platform
Windows Live Essentials
Windows Live Family Safety
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live Messenger Companion Core
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live Sync
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Yahoo! Detect
ZTE_1.2059.0.8
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
26/07/2012 16:40:22, Error: Service Control Manager [7005] - The LoadUserProfile call failed with the following error: Access is denied.
26/07/2012 16:38:41, Error: NetBT [4321] - The name "WORKGROUP :1d" could not be registered on the interface with IP address 192.168.0.10. The computer with the IP address 192.168.0.9 did not allow the name to be claimed by this computer.
26/07/2012 16:38:07, Error: Service Control Manager [7000] - The int15 service failed to start due to the following error: The system cannot find the file specified.
.
==== End Of File ===========================

Supawoman · 2012/08/07

That's the last of the logs for now... As I said, Thank you for your help in advance....

Supawoman · 2012/08/07

Hello, I've just noticed that only parts 2,3 and 4 of my GMER log have posted... do I need to repost the 1st and 5th part?

PeteC · 2012/08/07

do I need to repost the 1st and 5th part?
Click to expand...

No .....

As a new member with less than 10 posts any post you make which contains a URL requires approval (moderation) before it is visible.
Click to expand...

They should all be visible now.

broni · 2012/08/07

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.

If you're stuck, or you're not sure about certain step, always ask before doing anything else.

Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.

Never run more than one scan at a time.

Keep updating me regarding your computer behavior, good, or bad.

The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.

If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.

I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

=============================================

For x32 (x86) bit systems download Farbar Recovery Scan Tool 32-Bit and save it to a flash drive.
For x64 bit systems download Farbar Recovery Scan Tool 64-Bit and save it to a flash drive.

Plug the flashdrive into the infected PC.

Enter System Recovery Options.

[color= "#0000FF"]To enter System Recovery Options from the Advanced Boot Options:[/color]

Restart the computer.

As soon as the BIOS is loaded begin tapping the F8 key until Advanced Boot Options appears.

Use the arrow keys to select the Repair your computer menu item.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account an click Next.

[color= "#0000FF"]To enter System Recovery Options by using Windows installation disc:[/color]

Insert the installation disc.

Restart your computer.

If prompted, press any key to start Windows from the installation disc. If your computer is not configured to start from a CD or DVD, check your BIOS settings.

Click Repair your computer.

Select US as the keyboard language settings, and then click Next.

Select the operating system you want to repair, and then click Next.

Select your user account and click Next.

[color= "#008000"]On the System Recovery Options menu you will get the following options:[/color]

Startup Repair
System Restore
Windows Complete PC Restore
Windows Memory Diagnostic Tool
Command Prompt

Select Command Prompt

In the command window type in notepad and press Enter.

The notepad opens. Under File menu select Open.

Select "Computer" and find your flash drive letter and close the notepad.

In the command window type [color= "#FF0000"]e[/color]:\frst.exe (for x64 bit version type [color= "#FF0000"]e[/color]:\frst64) and press Enter
Note: Replace letter [color= "#FF0000"]e[/color] with the drive letter of your flash drive.

The tool will start to run.

When the tool opens click Yes to disclaimer.

Press Scan button.

It will make a log (FRST.txt) on the flash drive. Please copy and paste it to your reply.

Next...

Re-run FRST again.
Type the following in the edit box after "Search: ".

services.exe

Click Search button and post the log (Search.txt) it makes in your reply.

I'll expect two logs:
- FRST.txt
- Search.txt

Supawoman · 2012/08/07

Thank you for your help so far.
FRST.txt log
Scan result of Farbar Recovery Scan Tool (FRST written by Farbar) Version: 08-08-2012
Ran by SYSTEM at 07-08-2012 23:41:22
Running from F:\
Windows 7 Ultimate (X86) OS Language: English(US)
The current controlset is ControlSet001

========================== Registry (Whitelisted) =============

HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe -s [8120864 2011-03-29] (Realtek Semiconductor)
HKLM\...\Run: [Acer ePower Management] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [AmIcoSinglun] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2008-10-24] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [BackupManagerTray] "C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" -k [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [EgisTecLiveUpdate] "C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe" [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup [30192 2011-03-28] (Google)
HKLM\...\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe" [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [IAAnotif] C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe [186904 2009-06-04] (Intel Corporation)
HKLM\...\Run: [mwlDaemon] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [VitaKeyPdtWzd] "C:\Program Files\Acer Bio Protection\PdtWzd.exe" [3567616 2011-04-25] (Egis Technology Inc.)
HKLM\...\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe [217088 2011-04-25] (Alps Electric Co., Ltd.)
HKLM\...\Run: [LManager] C:\Program Files\Launch Manager\LManager.exe [1100368 2011-04-25] (Dritek System Inc.)
HKLM\...\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [843712 2012-01-02] (Adobe Systems Incorporated)
HKLM\...\Run: [ArcadeDeluxeAgent] "C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [419112 2011-01-28] (CyberLink Corp.)
HKLM\...\Run: [PlayMovie] "C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [181480 2011-01-28] (Acer Corp.)
HKLM\...\Run: [ProfilerU] C:\Program Files\Saitek\SD6\Software\ProfilerU.exe [227840 2010-07-29] (Saitek)
HKLM\...\Run: [SaiMfd] C:\Program Files\Saitek\SD6\Software\SaiMfd.exe [123392 2010-07-29] (Saitek)
HKLM\...\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe [49208 2011-05-09] (Hewlett-Packard)
HKLM\...\Run: [] [x]
HKLM\...\Run: [mcui_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey [1318816 2012-03-21] (McAfee, Inc.)
HKLM\...\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe" [252296 2012-01-17] (Sun Microsystems, Inc.)
HKLM\...\Run: [Reader Application Helper] C:\Program Files\Sony\ReaderDesktop\appHelper\ReaderAppHelper.exe [892928 2012-01-31] (Sony Corporation)
HKLM\...\Run: [Malwarebytes' Anti-Malware] "C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe" /starttray [462920 2012-07-03] (Malwarebytes Corporation)
HKU\Mcx1-RACHLAPTOP-PC\...\Winlogon: [Shell] C:\Windows\eHome\McrMgr.exe [313344 2009-07-13] (Microsoft Corporation)
HKU\Rachel Laptop\...\Run: [ProductReg] "C:\Program Files\Acer\WR_PopUp\ProductReg.exe" [135168 2008-11-17] (Acer)
HKU\Rachel Laptop\...\Run: [EA Core] "C:\Program Files\Electronic Arts\EADM\Core.exe" -silent [x]
HKU\Rachel Laptop\...\Run: [] [x]
HKU\Rachel Laptop\...\Run: [NokiaSuite.exe] C:\Program Files\Nokia\Nokia Suite\NokiaSuite.exe -tray [1084840 2012-05-16] (Nokia)
Tcpip\Parameters: [DhcpNameServer] 194.168.4.100 194.168.8.100
AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GO36F4~1.DLL
Lsa: [Notification Packages] C:\Program Files\Acer Bio Protection\PwdFilter
Startup: C:\Users\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk
ShortcutTarget: HP Digital Imaging Monitor.lnk -> C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe (Hewlett-Packard Co.)
Startup: C:\Users\All Users\Start Menu\Programs\Startup\McAfee Security Scan Plus.lnk
ShortcutTarget: McAfee Security Scan Plus.lnk -> C:\Program Files\McAfee Security Scan\2.0.181\SSScheduler.exe (McAfee, Inc.)

================================ Services (Whitelisted) ==================

2 BecHelperService; C:\Program Files\3 Mobile Broadband\3Connect\BecHelperService.exe [1737464 2010-01-28] ()
2 btwdins; C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe [578848 2009-04-13] (Broadcom Corporation.)
2 CLKMSVC10_D20A29D4; "C:\Program Files\Acer Arcade Deluxe\PlayMovie\NavFilter\kmsvc.exe" /svc [241648 2011-04-11] (CyberLink)
2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
2 eventlog; C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted [20992 2009-07-13] (Microsoft Corporation)
3 GoogleDesktopManager-051210-111108; "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [30192 2011-03-28] (Google)
2 IGBASVC; C:\Program Files\Acer Bio Protection\BASVC.exe [3450368 2011-04-25] (Egis Technology Inc.)
2 MBAMService; "C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe" [655944 2012-07-03] (Malwarebytes Corporation)
2 McAfee SiteAdvisor Service; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
3 McComponentHostService; "C:\Program Files\McAfee Security Scan\2.0.181\McCHSvc.exe" [227232 2010-01-15] (McAfee, Inc.)
2 McMPFSvc; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
2 mcmscsvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
2 McNaiAnn; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
2 McNASvc; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
3 McODS; "C:\Program Files\McAfee\VirusScan\mcods.exe" [361976 2012-04-18] (McAfee, Inc.)
2 McProxy; "C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
2 McShield; "C:\Program Files\Common Files\McAfee\SystemCore\\mcshield.exe" [166288 2012-03-20] (McAfee, Inc.)
2 mfefire; "C:\Program Files\Common Files\McAfee\SystemCore\\mfefire.exe" [161632 2012-03-20] (McAfee, Inc.)
2 mfevtp; "C:\Windows\system32\mfevtps.exe" [151880 2012-03-20] (McAfee, Inc.)
2 MOBKbackup; "C:\Program Files\McAfee Online Backup\MOBKbackup.exe" [229688 2010-04-13] (McAfee, Inc.)
2 MSK80Service; "C:\Program Files\Common Files\Mcafee\McSvcHost\McSvHost.exe" /McCoreSvc [214904 2011-01-27] (McAfee, Inc.)
2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
2 nvUpdatusService; C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [1262400 2012-05-15] (NVIDIA Corporation)
2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated)
3 Sony PC Companion; "C:\Program Files\Sony\Sony PC Companion\PCCService.exe" [155320 2012-01-18] (Avanquest Software)
3 Sony SCSI Helper Service; "C:\Program Files\Common Files\Sony Shared\Fsk\SonySCSIHelperService.exe" [73728 2011-11-17] (Sony Corporation)
3 WPFFontCache_v0400; C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [x]

========================== Drivers (Whitelisted) =============

3 AgereSoftModem; C:\Windows\System32\DRIVERS\AGRSM.sys [1035776 2009-07-13] (LSI Corp)
3 cfwids; C:\Windows\System32\drivers\cfwids.sys [57600 2012-02-22] (McAfee, Inc.)
2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [29744 2011-04-25] (EgisTec)
3 ggflt; C:\Windows\System32\DRIVERS\ggflt.sys [13224 2012-06-30] (Sony Ericsson Mobile Communications)
3 ggsemc; C:\Windows\System32\DRIVERS\ggsemc.sys [25512 2012-06-30] (Sony Ericsson Mobile Communications)
3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
3 k57nd60x; C:\Windows\System32\DRIVERS\k57nd60x.sys [223232 2008-09-03] (Broadcom Corporation)
3 libusb0; C:\Windows\System32\drivers\libusb0.sys [21504 2012-03-01] (http://libusb-win32.sourceforge.net)
3 MBAMProtector; \??\C:\Windows\system32\drivers\mbam.sys [22344 2012-07-03] (Malwarebytes Corporation)
3 mfeapfk; C:\Windows\System32\drivers\mfeapfk.sys [121544 2012-02-22] (McAfee, Inc.)
3 mfeavfk; C:\Windows\System32\drivers\mfeavfk.sys [180848 2012-02-22] (McAfee, Inc.)
3 mfebopk; C:\Windows\System32\drivers\mfebopk.sys [59456 2012-02-22] (McAfee, Inc.)
3 mfefirek; C:\Windows\System32\drivers\mfefirek.sys [340920 2012-02-22] (McAfee, Inc.)
0 mfehidk; C:\Windows\System32\drivers\mfehidk.sys [464304 2012-02-22] (McAfee, Inc.)
1 mfenlfk; C:\Windows\System32\DRIVERS\mfenlfk.sys [64912 2012-02-22] (McAfee, Inc.)
3 mferkdet; C:\Windows\System32\drivers\mferkdet.sys [87656 2012-02-22] (McAfee, Inc.)
0 mfewfpk; C:\Windows\System32\drivers\mfewfpk.sys [169608 2012-02-22] (McAfee, Inc.)
1 MOBKFilter; C:\Windows\System32\DRIVERS\MOBK.sys [54776 2010-04-13] (Mozy, Inc.)
1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
3 SaiH0004; C:\Windows\System32\DRIVERS\SaiH0004.sys [182528 2006-09-14] (Saitek)
3 SaiK0CCC; C:\Windows\System32\DRIVERS\SaiK0CCC.sys [138760 2010-08-10] (Saitek)
3 SaiL0004; C:\Windows\System32\DRIVERS\SaiL0004.sys [15104 2006-09-14] (Saitek)
3 SaiMini; C:\Windows\System32\DRIVERS\SaiMini.sys [20744 2010-08-10] (Saitek)
3 SaiNtBus; C:\Windows\System32\drivers\SaiBus.sys [43656 2010-08-10] (Saitek)
3 SaiU0004; C:\Windows\System32\DRIVERS\SaiU0004.sys [27392 2006-09-14] (Saitek)
3 SaiU0CCC; C:\Windows\System32\DRIVERS\SaiU0CCC.sys [35336 2010-08-10] (Saitek)
2 int15; \??\c:\Windows\system32\drivers\int15.sys [x]
3 mfeavfk01; [x]
3 Synth3dVsc; C:\Windows\System32\drivers\synth3dvsc.sys [x]
3 tsusbhub; C:\Windows\System32\drivers\tsusbhub.sys [x]
3 VGPU; C:\Windows\System32\drivers\rdvgkmd.sys [x]

========================== NetSvcs (Whitelisted) ===========

============ One Month Created Files and Folders ==============

2012-08-07 23:41 - 2012-08-07 23:41 - 00000000 ____D C:\FRST
2012-07-26 10:54 - 2012-07-26 10:54 - 00607260 ____R (Swearware) C:\Users\Rachel Laptop\Desktop\dds.scr
2012-07-26 08:45 - 2012-07-26 08:45 - 00001375 ____A C:\Users\Rachel Laptop\Downloads\URLLink (3).acsm
2012-07-26 08:04 - 2012-07-26 08:04 - 04731392 ____A (AVAST Software) C:\Users\Rachel Laptop\Desktop\aswMBR.exe
2012-07-26 07:57 - 2012-07-26 07:57 - 00000000 ____D C:\Program Files\Oracle
2012-07-26 07:56 - 2012-07-05 13:06 - 00227760 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2012-07-26 07:55 - 2012-06-26 16:43 - 00174064 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2012-07-26 07:55 - 2012-06-26 16:43 - 00174064 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2012-07-26 07:54 - 2012-07-26 07:55 - 00002942 ____A C:\Windows\System32\jupdate-1.7.0_05-b06.log
2012-07-16 23:34 - 2012-07-16 23:34 - 04024320 ____A C:\Program Files\GUT657.tmp
2012-07-16 23:34 - 2012-07-16 23:34 - 00000000 ____D C:\Program Files\GUM656.tmp
2012-07-12 12:39 - 2012-07-12 12:39 - 00302592 ____A C:\Users\Rachel Laptop\Desktop\e90pf28o.exe
2012-07-12 12:24 - 2012-07-12 12:24 - 00302592 ____A C:\Users\Rachel Laptop\Desktop\l6dfoiid.exe
2012-07-12 10:41 - 2012-07-12 10:41 - 00000000 ____D C:\Users\Rachel Laptop\AppData\Roaming\Malwarebytes
2012-07-12 10:40 - 2012-07-12 10:40 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-12 10:40 - 2012-07-12 10:40 - 00000000 ____D C:\Users\All Users\Malwarebytes
2012-07-12 10:40 - 2012-07-12 10:40 - 00000000 ____D C:\Program Files\Malwarebytes' Anti-Malware
2012-07-12 10:40 - 2012-07-03 04:46 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-12 10:38 - 2012-07-12 10:39 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Rachel Laptop\Desktop\mbam-setup-1.62.0.1300.exe
2012-07-12 07:27 - 2012-07-12 10:17 - 01838080 ____A (CPUID) C:\Users\Rachel Laptop\AppData\Roaming\siw_sdk.dll
2012-07-12 07:26 - 2012-07-12 07:26 - 00000893 ____A C:\Users\Rachel Laptop\Desktop\SIW.lnk
2012-07-12 07:26 - 2012-07-12 07:26 - 00000000 ____D C:\Program Files\SIW
2012-07-11 22:25 - 2012-07-11 22:25 - 00000083 ___RH C:\Users\Rachel Laptop\Desktop\GetSusp.opt
2012-07-11 21:39 - 2012-07-11 21:40 - 01501248 ____A (McAfee Inc.) C:\Users\Rachel Laptop\Desktop\GetSusp.exe
2012-07-11 21:39 - 2012-07-11 21:39 - 01501248 ____A (McAfee Inc.) C:\Users\Rachel Laptop\Downloads\GetSusp.exe
2012-07-11 13:11 - 2012-07-11 13:11 - 00302592 ____A C:\Users\Rachel Laptop\Downloads\c8mpuw24.exe
2012-07-10 12:34 - 2012-06-02 01:07 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-07-10 12:34 - 2012-06-02 00:43 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-07-10 12:34 - 2012-06-02 00:33 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-07-10 12:34 - 2012-06-02 00:26 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-07-10 12:34 - 2012-06-02 00:25 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-07-10 12:34 - 2012-06-02 00:25 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-07-10 12:34 - 2012-06-02 00:23 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-07-10 12:34 - 2012-06-02 00:21 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-07-10 12:34 - 2012-06-02 00:20 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-07-10 12:34 - 2012-06-02 00:19 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-07-10 12:34 - 2012-06-02 00:19 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-07-10 12:34 - 2012-06-02 00:17 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-07-10 12:34 - 2012-06-02 00:16 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-07-10 12:34 - 2012-06-02 00:14 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-07-10 12:26 - 2012-06-11 18:40 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-07-10 11:44 - 2012-06-05 21:05 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-07-10 11:44 - 2012-06-05 21:05 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-07-10 11:44 - 2012-06-05 21:03 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-07-10 11:44 - 2012-06-01 20:45 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-07-10 11:44 - 2012-06-01 20:45 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-07-10 11:44 - 2012-06-01 20:40 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-07-10 11:44 - 2012-06-01 20:40 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-07-10 11:44 - 2012-06-01 20:39 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-07-10 11:44 - 2010-06-25 19:24 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\msxml3r.dll
2012-07-10 11:43 - 2012-06-08 20:41 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll

============ 3 Months Modified Files ========================

2012-08-07 14:36 - 2011-04-25 02:52 - 02013537 ____A C:\Windows\WindowsUpdate.log
2012-08-07 14:33 - 2011-04-25 03:04 - 00730320 ____A C:\Windows\System32\PerfStringBackup.INI
2012-08-07 14:28 - 2011-04-25 02:12 - 00017088 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2012-08-07 14:28 - 2011-04-25 02:12 - 00017088 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2012-08-07 14:25 - 2012-03-07 14:09 - 00001832 ____A C:\Users\Public\Desktop\McAfee Internet Security.lnk
2012-08-07 14:20 - 2011-03-29 13:02 - 00000882 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2012-08-07 14:19 - 2009-07-13 20:53 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2012-08-07 14:19 - 2009-07-13 20:39 - 15504033 ____A C:\Windows\setupact.log
2012-08-07 13:48 - 2012-03-30 15:16 - 00000830 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2012-08-07 13:39 - 2011-03-29 13:02 - 00000886 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2012-08-07 10:00 - 2011-04-25 02:34 - 00133320 ____A C:\Windows\PFRO.log
2012-08-06 23:48 - 2012-03-30 15:16 - 00426184 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2012-08-06 23:48 - 2011-05-19 06:05 - 00070344 ____A (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2012-07-26 10:54 - 2012-07-26 10:54 - 00607260 ____R (Swearware) C:\Users\Rachel Laptop\Desktop\dds.scr
2012-07-26 08:45 - 2012-07-26 08:45 - 00001375 ____A C:\Users\Rachel Laptop\Downloads\URLLink (3).acsm
2012-07-26 08:04 - 2012-07-26 08:04 - 04731392 ____A (AVAST Software) C:\Users\Rachel Laptop\Desktop\aswMBR.exe
2012-07-26 07:55 - 2012-07-26 07:54 - 00002942 ____A C:\Windows\System32\jupdate-1.7.0_05-b06.log
2012-07-16 23:34 - 2012-07-16 23:34 - 04024320 ____A C:\Program Files\GUT657.tmp
2012-07-12 12:39 - 2012-07-12 12:39 - 00302592 ____A C:\Users\Rachel Laptop\Desktop\e90pf28o.exe
2012-07-12 12:24 - 2012-07-12 12:24 - 00302592 ____A C:\Users\Rachel Laptop\Desktop\l6dfoiid.exe
2012-07-12 10:40 - 2012-07-12 10:40 - 00001067 ____A C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
2012-07-12 10:39 - 2012-07-12 10:38 - 10652120 ____A (Malwarebytes Corporation ) C:\Users\Rachel Laptop\Desktop\mbam-setup-1.62.0.1300.exe
2012-07-12 10:17 - 2012-07-12 07:27 - 01838080 ____A (CPUID) C:\Users\Rachel Laptop\AppData\Roaming\siw_sdk.dll
2012-07-12 07:26 - 2012-07-12 07:26 - 00000893 ____A C:\Users\Rachel Laptop\Desktop\SIW.lnk
2012-07-11 22:25 - 2012-07-11 22:25 - 00000083 ___RH C:\Users\Rachel Laptop\Desktop\GetSusp.opt
2012-07-11 21:40 - 2012-07-11 21:39 - 01501248 ____A (McAfee Inc.) C:\Users\Rachel Laptop\Desktop\GetSusp.exe
2012-07-11 21:39 - 2012-07-11 21:39 - 01501248 ____A (McAfee Inc.) C:\Users\Rachel Laptop\Downloads\GetSusp.exe
2012-07-11 14:53 - 2012-02-13 11:52 - 00200192 __ASH C:\Users\Rachel Laptop\Desktop\Thumbs.db
2012-07-11 13:11 - 2012-07-11 13:11 - 00302592 ____A C:\Users\Rachel Laptop\Downloads\c8mpuw24.exe
2012-07-10 12:39 - 2009-07-13 20:33 - 00424040 ____A C:\Windows\System32\FNTCACHE.DAT
2012-07-10 12:34 - 2006-11-02 02:23 - 00000254 ____A C:\Windows\win.ini
2012-07-10 12:26 - 2011-05-01 01:33 - 57442464 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2012-07-09 14:51 - 2011-07-31 15:02 - 00004096 ___AH C:\Users\Rachel Laptop\AppData\Local\keyfile3.drm
2012-07-05 13:06 - 2012-07-26 07:56 - 00227760 ____A (Oracle Corporation) C:\Windows\System32\javaws.exe
2012-07-05 13:06 - 2012-05-16 12:04 - 00772544 ____A (Oracle Corporation) C:\Windows\System32\npDeployJava1.dll
2012-07-05 13:06 - 2011-08-11 09:12 - 00687544 ____A (Oracle Corporation) C:\Windows\System32\deployJava1.dll
2012-07-03 04:46 - 2012-07-12 10:40 - 00022344 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2012-07-02 12:24 - 2012-07-02 12:24 - 00000934 ____A C:\Users\Public\Desktop\calibre - E-book management.lnk
2012-07-02 12:22 - 2012-07-02 12:18 - 47543312 ____A C:\Users\Rachel Laptop\Downloads\calibre-0.8.58.msi
2012-06-30 14:13 - 2011-03-28 06:31 - 00496172 ____A C:\Windows\DPINST.LOG
2012-06-30 13:59 - 2012-06-30 13:59 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ggsemc_01007.Wdf
2012-06-30 13:59 - 2012-06-30 13:59 - 00000000 ___AH C:\Windows\System32\Drivers\Msft_Kernel_ggflt_01007.Wdf
2012-06-30 13:51 - 2012-06-30 13:51 - 00025512 ____A (Sony Ericsson Mobile Communications) C:\Windows\System32\Drivers\ggsemc.sys
2012-06-30 13:51 - 2012-06-30 13:51 - 00013224 ____A (Sony Ericsson Mobile Communications) C:\Windows\System32\Drivers\ggflt.sys
2012-06-26 16:43 - 2012-07-26 07:55 - 00174064 ____A (Oracle Corporation) C:\Windows\System32\javaw.exe
2012-06-26 16:43 - 2012-07-26 07:55 - 00174064 ____A (Oracle Corporation) C:\Windows\System32\java.exe
2012-06-23 08:47 - 2012-06-23 08:47 - 00002051 ____A C:\Users\Public\Desktop\Nokia Suite.lnk
2012-06-23 07:58 - 2009-07-13 20:53 - 00032608 ____A C:\Windows\Tasks\SCHEDLGU.TXT
2012-06-23 07:07 - 2012-06-23 07:07 - 00012943 ____A C:\Users\Rachel Laptop\Documents\keele timetable.xlsx
2012-06-20 11:03 - 2011-08-24 03:07 - 00004663 ____A C:\Windows\KB893803v2.log
2012-06-16 11:21 - 2012-06-16 11:21 - 00001345 ____A C:\Users\Rachel Laptop\Desktop\Media Center.lnk
2012-06-16 10:17 - 2012-06-16 10:17 - 00000020 ___SH C:\Users\Mcx1-RACHLAPTOP-PC\ntuser.ini
2012-06-16 10:16 - 2012-06-16 10:16 - 00000362 _RASH C:\Users\All Users\ntuser.pol
2012-06-15 13:20 - 2011-04-25 03:39 - 00112592 ____A C:\Users\Rachel Laptop\AppData\Local\GDIPFONTCACHEV1.DAT
2012-06-15 13:19 - 2011-04-24 22:40 - 00000376 ____A C:\Windows\ODBC.INI
2012-06-11 18:40 - 2012-07-10 12:26 - 02345984 ____A (Microsoft Corporation) C:\Windows\System32\win32k.sys
2012-06-08 20:41 - 2012-07-10 11:43 - 12873728 ____A (Microsoft Corporation) C:\Windows\System32\shell32.dll
2012-06-07 07:59 - 2012-06-07 07:59 - 00001630 ____A C:\Users\Rachel Laptop\Downloads\URLLink (2).acsm
2012-06-07 07:58 - 2012-06-07 07:58 - 00001718 ____A C:\Users\Rachel Laptop\Downloads\URLLink (1).acsm
2012-06-07 07:57 - 2012-06-07 07:57 - 00001637 ____A C:\Users\Rachel Laptop\Downloads\URLLink.acsm
2012-06-06 23:10 - 2012-06-06 23:10 - 00002124 ____A C:\Users\Public\Desktop\Adobe Digital Editions.lnk
2012-06-05 21:05 - 2012-07-10 11:44 - 01390080 ____A (Microsoft Corporation) C:\Windows\System32\msxml6.dll
2012-06-05 21:05 - 2012-07-10 11:44 - 01236992 ____A (Microsoft Corporation) C:\Windows\System32\msxml3.dll
2012-06-05 21:03 - 2012-07-10 11:44 - 00805376 ____A (Microsoft Corporation) C:\Windows\System32\cdosys.dll
2012-06-04 04:22 - 2012-06-04 04:22 - 00002272 ____A C:\Users\Rachel Laptop\Desktop\Kindle.lnk
2012-06-03 16:45 - 2012-06-03 16:45 - 00002027 ____A C:\Users\Public\Desktop\Reader for PC.lnk
2012-06-02 14:19 - 2012-06-21 09:04 - 01933848 ____A (Microsoft Corporation) C:\Windows\System32\wuaueng.dll
2012-06-02 14:19 - 2012-06-21 09:04 - 00053784 ____A (Microsoft Corporation) C:\Windows\System32\wuauclt.exe
2012-06-02 14:19 - 2012-06-21 09:04 - 00045080 ____A (Microsoft Corporation) C:\Windows\System32\wups2.dll
2012-06-02 14:19 - 2012-06-21 09:03 - 00577048 ____A (Microsoft Corporation) C:\Windows\System32\wuapi.dll
2012-06-02 14:19 - 2012-06-21 09:03 - 00035864 ____A (Microsoft Corporation) C:\Windows\System32\wups.dll
2012-06-02 14:12 - 2012-06-21 09:04 - 02422272 ____A (Microsoft Corporation) C:\Windows\System32\wucltux.dll
2012-06-02 14:12 - 2012-06-21 09:03 - 00088576 ____A (Microsoft Corporation) C:\Windows\System32\wudriver.dll
2012-06-02 06:19 - 2012-06-21 09:03 - 00171904 ____A (Microsoft Corporation) C:\Windows\System32\wuwebv.dll
2012-06-02 06:12 - 2012-06-21 09:03 - 00033792 ____A (Microsoft Corporation) C:\Windows\System32\wuapp.exe
2012-06-02 01:07 - 2012-07-10 12:34 - 12314624 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2012-06-02 00:43 - 2012-07-10 12:34 - 09737728 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2012-06-02 00:33 - 2012-07-10 12:34 - 01800192 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2012-06-02 00:26 - 2012-07-10 12:34 - 01103872 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2012-06-02 00:25 - 2012-07-10 12:34 - 01427968 ____A (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2012-06-02 00:25 - 2012-07-10 12:34 - 01129472 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2012-06-02 00:23 - 2012-07-10 12:34 - 00231936 ____A (Microsoft Corporation) C:\Windows\System32\url.dll
2012-06-02 00:21 - 2012-07-10 12:34 - 00065024 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2012-06-02 00:20 - 2012-07-10 12:34 - 00142848 ____A (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2012-06-02 00:19 - 2012-07-10 12:34 - 01793024 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2012-06-02 00:19 - 2012-07-10 12:34 - 00716800 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2012-06-02 00:17 - 2012-07-10 12:34 - 00073216 ____A (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2012-06-02 00:16 - 2012-07-10 12:34 - 02382848 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2012-06-02 00:14 - 2012-07-10 12:34 - 00176640 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2012-06-01 20:45 - 2012-07-10 11:44 - 00134000 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecpkg.sys
2012-06-01 20:45 - 2012-07-10 11:44 - 00067440 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\ksecdd.sys
2012-06-01 20:40 - 2012-07-10 11:44 - 00369336 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\cng.sys
2012-06-01 20:40 - 2012-07-10 11:44 - 00225280 ____A (Microsoft Corporation) C:\Windows\System32\schannel.dll
2012-06-01 20:39 - 2012-07-10 11:44 - 00219136 ____A (Microsoft Corporation) C:\Windows\System32\ncrypt.dll
2012-05-27 09:43 - 2012-05-27 09:43 - 00000985 ____A C:\Users\Public\Desktop\Kobo.lnk
2012-05-27 09:40 - 2012-05-27 08:32 - 53147816 ____A C:\Users\Rachel Laptop\Downloads\KoboSetup.exe
2012-05-23 11:53 - 2012-05-23 11:53 - 00000020 ___SH C:\Users\UpdatusUser\ntuser.ini
2012-05-22 23:36 - 2012-05-22 23:35 - 170607688 ____A (NVIDIA Corporation) C:\Users\Rachel Laptop\Downloads\301.42-notebook-win7-winvista-32bit-international-whql.exe
2012-05-19 01:16 - 2012-05-19 01:16 - 04485448 ____A (Piriform Ltd) C:\Users\Rachel Laptop\Downloads\spsetup116.exe
2012-05-16 09:54 - 2012-05-16 09:54 - 00892360 ____A (Oracle Corporation) C:\Users\Rachel Laptop\Downloads\JavaSetup7u4.exe
2012-05-16 09:05 - 2012-05-16 09:05 - 00278561 ____A C:\Users\Rachel Laptop\Downloads\Minecraft.exe
2012-05-15 02:26 - 2012-05-23 11:51 - 00061248 ____A (Khronos Group) C:\Windows\System32\OpenCL.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 19607872 ____A (NVIDIA Corporation) C:\Windows\System32\nvoglv32.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 17551680 ____A (NVIDIA Corporation) C:\Windows\System32\nvcompiler.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 15322432 ____A (NVIDIA Corporation) C:\Windows\System32\nvd3dum.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 11354944 ____A (NVIDIA Corporation) C:\Windows\System32\Drivers\nvlddmkm.sys
2012-05-15 02:26 - 2012-05-23 11:47 - 08105280 ____A (NVIDIA Corporation) C:\Windows\System32\nvwgf2um.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 05982528 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuda.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 02524992 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvid.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 02445120 ____A (NVIDIA Corporation) C:\Windows\System32\nvcuvenc.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 02368832 ____A (NVIDIA Corporation) C:\Windows\System32\nvapi.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 01000768 ____A (NVIDIA Corporation) C:\Windows\System32\nvdispco32.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 00883008 ____A (NVIDIA Corporation) C:\Windows\System32\nvgenco32.dll
2012-05-15 02:26 - 2012-05-23 11:47 - 00011190 ____A C:\Windows\System32\nvinfo.pb
2012-05-15 01:28 - 2012-05-23 11:51 - 03931456 ____A (NVIDIA Corporation) C:\Windows\System32\nvcpl.dll
2012-05-15 01:28 - 2012-05-23 11:51 - 02561344 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvcr.dll
2012-05-15 01:28 - 2012-05-23 11:51 - 00645440 ____A (NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
2012-05-15 01:28 - 2012-05-23 11:51 - 00108352 ____A (NVIDIA Corporation) C:\Windows\System32\nvmctray.dll
2012-05-15 01:28 - 2012-05-23 11:51 - 00062272 ____A (NVIDIA Corporation) C:\Windows\System32\nvshext.dll
2012-05-15 01:27 - 2012-05-23 11:51 - 02759488 ____A (NVIDIA Corporation) C:\Windows\System32\nvsvc.dll

ZeroAccess:
C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c}
C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c}\@
C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c}\L
C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c}\U

========================= Known DLLs (Whitelisted) ============

========================= Bamital & volsnap Check ============

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

========================= Memory info ======================

Percentage of memory in use: 12%
Total physical RAM: 4090.93 MB
Available physical RAM: 3593.02 MB
Total Pagefile: 4089.21 MB
Available Pagefile: 3601.47 MB
Total Virtual: 2047.88 MB
Available Virtual: 1968.7 MB

======================= Partitions =========================

1 Drive c: (ACER) (Fixed) (Total:285.32 GB) (Free:182.94 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
2 Drive d: (PQSERVICE) (Fixed) (Total:9.76 GB) (Free:1.14 GB) FAT32
4 Drive f: (THESIMS3CE) (Removable) (Total:1.8 GB) (Free:1.7 GB) FAT
5 Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

Disk ### Status Size Free Dyn Gpt
-------- ------------- ------- ------- --- ---
Disk 0 Online 298 GB 0 B
Disk 1 Online 1840 MB 0 B

Partitions of Disk 0:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
Partition 1 Recovery 9 GB 1024 KB
Partition 2 Primary 285 GB 9 GB
Partition 3 OEM 3072 MB 295 GB

==================================================================================

Disk: 0
Partition 1
Type : 27
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 2 D PQSERVICE FAT32 Partition 9 GB Healthy Hidden

==================================================================================

Disk: 0
Partition 2
Type : 07
Hidden: No
Active: Yes

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 1 C ACER NTFS Partition 285 GB Healthy

==================================================================================

Disk: 0
Partition 3
Type : 12
Hidden: Yes
Active: No

Volume ### Ltr Label Fs Type Size Status Info
---------- --- ----------- ----- ---------- ------- --------- --------
* Volume 4 NTFS Partition 3072 MB Healthy Hidden

==================================================================================

Partitions of Disk 1:
===============

Partition ### Type Size Offset
------------- ---------------- ------- -------
* Partition 1 Primary 1840 MB 0 B

==================================================================================

Disk: 1
There is no partition selected.

There is no partition selected.
Please select a partition and try again.

==================================================================================

==========================================================

Last Boot: 2012-07-09 11:44

======================= End Of Log ==========================

Supawoman · 2012/08/07

Search.txt log
Farbar Recovery Scan Tool Version: 08-08-2012
Ran by SYSTEM at 2012-08-07 23:43:57
Running from F:\

================== Search: "services.exe" ===================

C:\Windows\winsxs\x86_microsoft-windows-s..s-servicecontroller_31bf3856ad364e35_6.1.7600.16385_none_cf36168b2e9c967b\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

C:\Windows\System32\services.exe
[2009-07-13 15:11] - [2009-07-13 17:14] - 0259072 ____A (Microsoft Corporation) 5F1B6A9C35D3D5CA72D6D6FDEF9747D6

=== End Of Search ===

Supawoman · 2012/08/07

When I chose the 'repair your computer' option I was prompted to select my sign-on and enter my password to log on. What I noticed was that apart from my logon, there were 3 other sign-ons i.e. 4 including mine but there is only one sign on avail for my computer, I don't have any other users set up on it.

broni · 2012/08/07

Download attached fixlist.txt file and save it to the very same USB flash drive you've been using. Plug the drive back in.

NOTICE: This script was written specifically for this user, for use on that particular machine. Running this on another machine may cause damage to your operating system

On Vista or Windows 7: Now please enter System Recovery Options.
On Windows XP: Now please boot into the UBCD.
Run [color= "#0000FF"]FRST/FRST64[/color] and press the Fix button just once and wait.
The tool will make a log on the flashdrive (Fixlog.txt) please post it to your reply.

Next...

Restart normally.

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.

Close any open browsers.

Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".

Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.

Close any open browsers.

WARNING: Combofix will disconnect your machine from the Internet as soon as it starts

Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.

If there is no internet connection after running Combofix, then restart your computer to restore back your connection.

Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.

Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results ". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: http://www.appremover.com/
We can reinstall it when we're done with CF.
**Note 3: If you receive an error "Illegal operation attempted on a registery key that has been marked for deletion ", restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try one of the following:

1. Run Combofix from Safe Mode.

2. Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Please download and run the below tool named Rkill (courtesy of BleepingComputer.com) which may help allow other programs to run.
There are 4 different versions. If one of them won't run then download and try to run the other one.
Vista and Win7 users need to right click Rkill and choose Run as Administrator
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

* Rkill.com
* Rkill.scr
* Rkill.exe

Double-click on the Rkill icon to run the tool.

If using Vista or Windows 7 right-click on it and choose Run As Administrator.

A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.

If not, delete the file, then download and use the one provided in Link 2.

If it does not work, repeat the process and attempt to use one of the remaining links until the tool runs.

Do not reboot until instructed.

If the tool does not run from any of the links provided, please let me know.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

If normal mode still doesn't work, run BOTH tools from safe mode.

In case #2, please post BOTH logs, rKill and Combofix.

DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!

Supawoman · 2012/08/08

As I need to disable my internet security to run combofix, should I disconnect from the internet before disabling everything and then run it?

Supawoman · 2012/08/08

FRST - fixlog.txt

Fix result of Farbar Recovery Tool (FRST written by Farbar) Version: 08-08-2012
Ran by SYSTEM at 2012-08-08 16:43:27 Run:1
Running from F:\

==============================================

HKEY_LOCAL_MACHINE\System\ControlSet001\Control\Session Manager\SubSystems\\Windows No ZeroAccess entry found.
C:\Windows\System32\consrv.dll not found.
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ Default Value restored successfully.
HKEY_USERS\Rachel Laptop\Software\Microsoft\Windows\CurrentVersion\Run\\ProductReg Value deleted successfully.
C:\Users\Rachel Laptop\AppData\Local\{b705a84b-260a-fbc4-c301-fa8522f3253c} moved successfully.

==== End of Fixlog ====

Log in or Sign up

Solved Trojan Zero Access found by McAfee... can you help?

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Share This Page

Log in or Sign up

Solved Trojan Zero Access found by McAfee... can you help?

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

PeteC SuperGeek Staff

broni Moderator Malware Analyst

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

broni Moderator Malware Analyst

Attached Files:

fixlist.txt

Supawoman Inactive Thread Starter

Supawoman Inactive Thread Starter

Share This Page

Useful Searches