Please Help !!!!!

nishikamae

Logfile of HijackThis v1.99.1
Scan saved at 14:37:11, on 16/10/2550
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0011)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\CyberLink\Shared Files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\Multimedia Card Reader\shwicon2k.exe
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\SmartAdviser\EZAD\svchost.exe
C:\Program Files\QuickTime\QTTask.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\Program Files\ViOrb\ViOrb.exe
C:\Program Files\ViStart\ViStart.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.windowsxlive.net
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan Enterprise\Scriptcl.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - C:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [System Files Updater] C:\WINDOWS\FlyakiteOSX\Tools\System Files Updater.exe /S
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [LanguageShortcut] "C:\Program Files\CyberLink\PowerDVD\Language\Language.exe"
O4 - HKLM\..\Run: [EzTruehitNews] "C:\Program Files\SmartAdviser\EZAD\svchost.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [C:\WINDOWS\Config\load.exe] C:\WINDOWS\Config\load.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [UIWatcher] C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [viwc] C:\WINDOWS\system32\viwc.exe
O4 - HKCU\..\Run: [ViOrb] C:\Program Files\ViOrb\ViOrb.exe
O4 - HKCU\..\Run: [ViStart] C:\Program Files\ViStart\ViStart.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &ดาวน์โหลดทั้งหมดโดยใช้ FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &ดาวน์โหลดโดยใช้ FlashGet - C:\Program Files\FlashGet\jc_link.htm
O9 - Extra button: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra 'Tools' menuitem: IE7pro Preferences - {0026439F-A980-4f18-8C95-4F1CBBF9C1D8} - C:\WINDOWS\system32\shdocvw.dll
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {23D236EA-B936-4B2B-900C-D0E8DBBF9570} (BugsGameStarts Class) - http://audition.playpark.com/nProtect/CStart/ThaiGameStart.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by117w.bay117.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {82FFA573-38AA-482A-99AD-91F697B91631} (Installer.InstallControl) - http://www.file2you.net/applet.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{4484DB0A-B788-4018-A8DF-6021AF33C507}: NameServer = 203.144.207.29 203.144.207.49
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\sulimo.dat
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - (no file)
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Unknown owner - C:\Program Files\McAfee\Common Framework\FrameworkService.exe" /ServiceStart (file missing)
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: npkcsvc - INCA Internet Co., Ltd. - C:\WINDOWS\system32\npkcsvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Program Files\CyberLink\Shared Files\RichVideo.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\Common Files\PCSuite\Services\ServiceLayer.exe
 
Hi

I have to say that your situation doesn't look good.

Some rootkits files have come back.

We can of course continue cleaning process if you like.
 
Hi

No but I can't guarantee that we get you clean.

If you like to continue, we must do further research.
 
Hi

* Download GMER from
here:
Unzip it and start GMER.exe
Click the rootkit-tab and click scan.

Once done, click the Copy button.
This will copy the results to clipboard.
Paste the results in your next reply.
 
nishikamae

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-10-16 21:49:19
Windows 5.1.2600 Service Pack 2


---- System - GMER 1.0.13 ----

SSDT d347bus.sys ZwClose
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwCreateFile
SSDT d347bus.sys ZwCreateKey
SSDT d347bus.sys ZwCreatePagingFile
SSDT d347bus.sys ZwEnumerateKey
SSDT d347bus.sys ZwEnumerateValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwOpenFile
SSDT d347bus.sys ZwOpenKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryDirectoryFile
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwQueryInformationProcess
SSDT d347bus.sys ZwQueryKey
SSDT d347bus.sys ZwQueryValueKey
SSDT \??\C:\WINDOWS\system32\windrvNT.sys ZwSetInformationFile
SSDT d347bus.sys ZwSetSystemPowerState

Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys ZwCreateProcess
Code \SystemRoot\system32\drivers\mfehidk.sys ZwDeleteKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwDeleteValueKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwMapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys ZwProtectVirtualMemory
Code \SystemRoot\system32\drivers\mfehidk.sys ZwRenameKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwSetValueKey
Code \SystemRoot\system32\drivers\mfehidk.sys ZwTerminateProcess
Code \SystemRoot\system32\drivers\mfehidk.sys ZwUnmapViewOfSection
Code \SystemRoot\system32\drivers\mfehidk.sys ZwYieldExecution
Code \SystemRoot\system32\drivers\mfehidk.sys NtCreateFile
Code \SystemRoot\system32\drivers\mfehidk.sys NtMapViewOfSection

---- Kernel code sections - GMER 1.0.13 ----

.text ntoskrnl.exe!ZwYieldExecution 80509014 7 Bytes JMP B8DD988E \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwProtectVirtualMemory 805793A1 7 Bytes JMP B8DD9864 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!NtCreateFile 8057D3C4 5 Bytes JMP B8DD9850 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwUnmapViewOfSection 8057E2A3 5 Bytes JMP B8DD98BA \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!NtMapViewOfSection 8057E71B 7 Bytes JMP B8DD98A4 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwSetValueKey 8057FF13 7 Bytes JMP B8DD9826 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwTerminateProcess 8058C399 5 Bytes JMP B8DD983C \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwDeleteValueKey 805969F3 7 Bytes JMP B8DD9810 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwDeleteKey 80598177 7 Bytes JMP B8DD97E4 \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwCreateProcess 805C0BF0 5 Bytes JMP B8DD987A \SystemRoot\system32\drivers\mfehidk.sys
PAGE ntoskrnl.exe!ZwRenameKey 8065410B 7 Bytes JMP B8DD97FA \SystemRoot\system32\drivers\mfehidk.sys

---- User code sections - GMER 1.0.13 ----

.text C:\WINDOWS\system32\svchost.exe[176] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00A80FE5
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00A80F77
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00A80F92
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00A8006C
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00A80FAF
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00A80051
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00A800C9
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00A800A2
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00A80F55
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00A80F66
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00A80109
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00A80FCA
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00A8000A
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00A80091
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00A8002C
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00A8001B
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00A800E4
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00A70FDE
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00A70F8D
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00A70FEF
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00A70025
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00A70FA8
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00A70FC3
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00A7000A
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00A7004A
.text C:\Program Files\MSN Messenger\usnsvc.exe[504] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00650429
.text C:\WINDOWS\system32\winlogon.exe[576] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 004B0429
.text C:\WINDOWS\system32\winlogon.exe[576] WS2_32.dll!connect 71AB406A 5 Bytes JMP 004B0536
.text C:\WINDOWS\system32\winlogon.exe[576] WS2_32.dll!send 71AB428A 5 Bytes JMP 004B05E0
.text C:\WINDOWS\system32\winlogon.exe[576] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 004B0553
.text C:\WINDOWS\system32\services.exe[628] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 005B0429
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00F70FEF
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00F70F68
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00F7005D
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00F70040
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00F70F8D
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00F70FA8
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00F7007A
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00F70F32
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!
 
nishikamae

CreateProcessW 7C802332 5 Bytes JMP 00F700BA
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00F7009F
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00F700CB
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00F7002F
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00F7000A
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00F70F4D
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00F70FB9
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00F70FD4
.text C:\WINDOWS\system32\services.exe[628] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00F70F17
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00F6002C
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00F6007A
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00F6001B
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00F60000
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00F60069
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00F60058
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00F60FE5
.text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00F60047
.text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00F30FEF
.text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!connect 71AB406A 5 Bytes JMP 005B0536
.text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!send 71AB428A 5 Bytes JMP 005B05E0
.text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 005B0553
.text C:\WINDOWS\system32\services.exe[628] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00F40FEF
.text C:\WINDOWS\system32\services.exe[628] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00F40FDE
.text C:\WINDOWS\system32\services.exe[628] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00F40FC3
.text C:\WINDOWS\system32\services.exe[628] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 00F40FB2
.text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00EB0000
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00EB00BC
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00EB00A1
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00EB0084
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00EB0073
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00EB0047
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00EB0F8F
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00EB00D7
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00EB00E8
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00EB0F4F
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00EB0F3E
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00EB0058
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00EB0011
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00EB0FAC
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00EB0036
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00EB0FE5
.text C:\WINDOWS\system32\lsass.exe[640] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00EB0F6A
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00DF0FD4
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00DF006C
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00DF0FE5
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00DF001B
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00DF0051
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00DF0040
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00DF000A
.text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00DF0FB9
.text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00DC0FE5
.text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!send
71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\system32\lsass.exe[640] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00DD0FEF
.text C:\WINDOWS\system32\lsass.exe[640] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00DD0FDE
.text C:\WINDOWS\system32\lsass.exe[640] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00DD000A
.text C:\WINDOWS\system32\lsass.exe[640] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 00DD001B
.text C:\WINDOWS\system32\svchost.exe[808] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00B30FE5
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00B30062
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00B30F6D
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00B30047
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00B30F94
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00B30FAF
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00B30089
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00B30F41
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00B30F26
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00B300B5
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00B30F01
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00B30036
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00B30000
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00B30F52
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00B3001B
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00B30FCA
.text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00B300A4
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00B20040
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00B200AC
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00B2002F
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00B20FEF
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00B2009B
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00B20076
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00B2000A
.text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00B20065
 
nishikamae

.text C:\WINDOWS\system32\svchost.exe[808] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00AF0000
.text C:\WINDOWS\system32\svchost.exe[808] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\system32\svchost.exe[808] WS2_32.dll!send 71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\system32\svchost.exe[808] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\system32\svchost.exe[808] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00B00000
.text C:\WINDOWS\system32\svchost.exe[808] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00B00FDB
.text C:\WINDOWS\system32\svchost.exe[808] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00B00FCA
.text C:\WINDOWS\system32\svchost.exe[808] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 00B00025
.text C:\WINDOWS\system32\svchost.exe[864] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00CB0FEF
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00CB0F66
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00CB0F77
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00CB0051
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00CB0036
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00CB0025
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00CB009D
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00CB0F55
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00CB00C2
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00CB0F29
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00CB0F0E
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00CB0F9E
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00CB0FDE
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00CB0076
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00CB0FB9
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00CB0014
.text C:\WINDOWS\system32\svchost.exe[864] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00CB0F44
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00CA0FE5
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00CA006C
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00CA0036
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00CA001B
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00CA0FAF
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00CA0051
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00CA000A
.text C:\WINDOWS\system32\svchost.exe[864] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00CA0FCA
.text C:\WINDOWS\system32\svchost.exe[864] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00C7000A
.text C:\WINDOWS\system32\svchost.exe[864] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\system32\svchost.exe[864] WS2_32.dll!send 71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\system32\svchost.exe[864] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\system32\svchost.exe[864] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00C80FEF
.text C:\WINDOWS\system32\svchost.exe[864] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00C80014
.text C:\WINDOWS\system32\svchost.exe[864] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00C80025
.text C:\WINDOWS\system32\svchost.exe[864] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 00C80FD4
.text C:\Program Files\Windows Defender\MsMpEng.exe[940] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00580429
.text C:\Program Files\Windows Defender\MsMpEng.exe[940] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00580536
.text C:\Program Files\Windows Defender\MsMpEng.exe[940] WS2_32.dll!send 71AB428A 5 Bytes JMP 005805E0
.text C:\Program Files\Windows Defender\MsMpEng.exe[940] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00580553
.text C:\WINDOWS\System32\svchost.exe[1016] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01EF0000
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01EF0F52
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01EF0F6D
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01EF0051
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01EF0F94
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01EF0036
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01EF007F
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01EF0F37
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01EF009A
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01EF0F0B
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 01EF00AB
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 01EF0FAF
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 01EF0011
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 01EF0062
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 01EF0FC0
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 01EF0FDB
.text C:\WINDOWS\System32\svchost.exe[1016] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 01EF0F1C
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 01EE0022
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 01EE0047
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 01EE0011
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 01EE0000
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 01EE0F8A
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 01EE0F9B
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 01EE0FEF
.text C:\WINDOWS\System32\svchost.exe[1016] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 01EE0FB6
.text C:\WINDOWS\System32\svchost.exe[1016] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01CF000A
.text C:\WINDOWS\System32\svchost.exe[1016] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\System32\svchost.exe[1016] WS2_32.dll!send 71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\System32\svchost.exe[1016] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\System32\svchost.exe[1016] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 01D00FEF
.text C:\WINDOWS\System32\svchost.exe[1016] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 01D00FD4
.text C:\WINDOWS\System32\svchost.exe[1016] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 01D00014
.text C:\WINDOWS\System32\svchost.exe[1016] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 01D00FC3
.text C:\WINDOWS\system32\svchost.exe[1140] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00AD0000
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00AD0F7C
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00AD007B
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00AD0F97
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00AD004A
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00AD0FB2
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00AD00A9
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00AD0098
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00AD0F32
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00AD00CB
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00AD00E6
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00AD0039
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00AD0FEF
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00AD0F61
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00AD0FC3
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00AD0FDE
.text C:\WINDOWS\system32\svchost.exe[1140] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00AD00BA
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00AC0036
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00AC0F83
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00AC0FE5
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00AC001B
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00AC0F94
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00AC0FAF
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00AC0000
.text C:\WINDOWS\system32\svchost.exe[1140] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00AC0FC0
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00A90FEF
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!send 71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\system32\svchost.exe[1140] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\system32\svchost.exe[1140] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00AA0FEF
.text C:\WINDOWS\system32\svchost.exe[1140] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00AA0FD4
.text C:\WINDOWS\system32\svchost.exe[1140] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00AA0FC3
.text C:\WINDOWS\system32\svchost.exe[1140] wininet.dll!InternetOpenUrlW
 
nishikamae

77215A51 5 Bytes JMP 00AA0FA8
.text C:\WINDOWS\system32\svchost.exe[1212] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 006B0429
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00B60000
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00B60F4E
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00B60F5F
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00B60F7C
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00B60F8D
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00B60FB9
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00B60F2C
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00B60F3D
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 00B600AA
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00B60099
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00B600BB
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00B60FA8
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00B60FE5
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes J
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00B60025
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00B60FD4
.text C:\WINDOWS\system32\svchost.exe[1212] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 00B60F1B
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00A40036
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 00A4008E
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 00A4001B
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00A4000A
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00A4007D
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00A4006C
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00A40FEF
.text C:\WINDOWS\system32\svchost.exe[1212] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00A40051
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 00A10000
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!connect 71AB406A 5 Bytes JMP 006B0536
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!send 71AB428A 5 Bytes JMP 006B05E0
.text C:\WINDOWS\system32\svchost.exe[1212] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 006B0553
.text C:\WINDOWS\system32\svchost.exe[1212] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 00A20FEF
.text C:\WINDOWS\system32\svchost.exe[1212] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 00A20FD4
.text C:\WINDOWS\system32\svchost.exe[1212] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 00A20FC3
.text C:\WINDOWS\system32\svchost.exe[1212] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 00A20FA8
.text C:\WINDOWS\system32\spoolsv.exe[1332] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00930429
.text C:\WINDOWS\system32\spoolsv.exe[1332] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00930536
.text C:\WINDOWS\system32\spoolsv.exe[1332] WS2_32.dll!send 71AB428A 5 Bytes JMP 009305E0
.text C:\WINDOWS\system32\spoolsv.exe[1332] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00930553
.text C:\Documents and Settings\user\Desktop\gmer.exe[1344] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A00429
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003C0429
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 00250FEF
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00250F74
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00250073
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00250062
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00250FA5
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00250FD4
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00250F43
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00250095
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 002500D2
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 002500B7
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00250F28
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00250051
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 00250014
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00250084
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 00250040
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 0025002F
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 002500A6
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00340FDB
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 0034006C
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 0034002C
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 0034001B
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00340051
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00340FAF
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00340000
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00340FC0
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!DialogBoxParamW 77D5737A 5 Bytes JMP 00C55415 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!DialogBoxIndirectParamW 77D6204B 5 Bytes JMP 00DEC510 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!MessageBoxIndirectA 77D6A062 5 Bytes JMP 00DEC491 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!DialogBoxParamA 77D6B124 5 Bytes JMP 00DEC4D5 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!MessageBoxExW 77D80540 5 Bytes JMP 00DEC3D9 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!MessageBoxExA 77D80564 5 Bytes JMP 00DEC413 C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!DialogBoxIndirectParamA 77D86CB5 5 Bytes JMP 00DEC54B C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] USER32.dll!MessageBoxIndirectW 77D9609B 5 Bytes JMP 00DEC44D C:\WINDOWS\system32\IEFRAME.dll
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] WININET.dll!InternetOpenA 771CA6DD 5 Bytes JMP 01F10000
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] WININET.dll!InternetOpenW 771CAFC2 5 Bytes JMP 01F10FE5
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] WININET.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 01F10FCA
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] WININET.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 01F10FB9
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ws2_32.dll!socket 71AB3B91 5 Bytes JMP 024E0000
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ws2_32.dll!connect 71AB406A 5 Bytes JMP 003C0536
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ws2_32.dll!send 71AB428A 5 Bytes JMP 003C05E0
.text C:\Program Files\Internet Explorer\iexplore.exe[1368] ws2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003C0553
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1440] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00680429
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1440] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00680536
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1440] WS2_32.dll!send 71AB428A 5 Bytes JMP 006805E0
.text C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe[1440] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00680553 MP 00B6005E
 
nishikamae

.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00710429
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 01B50FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 01B50F69
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 01B50F7A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 01B50054
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 01B50F97
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 01B50FB2
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 01B50F3D
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 01B50F4E
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 01B500CC
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 01B500BB
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 01B500DD
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 01B50039
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 01B50FDE
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 01B50079
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 01B5001E
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 01B50FCD
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 01B500AA
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 01B40FAF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 01B40F8A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 01B40FCA
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 01B40000
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 01B40051
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 01B40036
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 01B40FE5
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 01B4001B
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01B1000A
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00710536
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] WS2_32.dll!send 71AB428A 5 Bytes JMP 007105E0
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00710553
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 01B20FEF
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 01B20FD4
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 01B20FC3
.text C:\Program Files\McAfee\Common Framework\FrameworkService.exe[1512] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 01B20014
.text C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe[1568] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00690429
.text C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe[1568] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00690536
.text C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe[1568] WS2_32.dll!send 71AB428A 5 Bytes JMP 006905E0
.text C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe[1568] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00690553
.text C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe[1620] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00700429
.text C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe[1620] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00700536
.text C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe[1620] WS2_32.dll!send 71AB428A 5 Bytes JMP 007005E0
.text C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe[1620] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00700553
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00710429
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateFileA 7C801A24 3 Bytes JMP 010C0000
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateFileA + 4 7C801A28 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!VirtualProtectEx 7C801A5D 1 Byte [ E9 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!VirtualProtectEx + 2 7C801A5F 1 Byte [ F4 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!VirtualProtectEx + 4 7C801A61 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!VirtualProtect 7C801AD0 3 Bytes JMP 010C0F72
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!VirtualProtect + 4 7C801AD4 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 010C004C
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryExA 7C801D4F 3 Bytes JMP 010C0F83
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryExA + 4 7C801D53 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryA 7C801D77 3 Bytes JMP 010C0FB9
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryA + 4 7C801D7B 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!GetStartupInfoW 7C801E50 3 Bytes JMP 010C0F35
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!GetStartupInfoW + 4 7C801E54 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 010C007D
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateProcessW 7C802332 3 Bytes JMP 010C00BA
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateProcessW + 4 7C802336 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateProcessA 7C802367 3 Bytes JMP 010C00A9
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateProcessA + 4 7C80236B 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!GetProcAddress 7C80ADC0 3 Bytes JMP 010C0F06
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!GetProcAddress + 4 7C80ADC4 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryW 7C80AE6B 3 Bytes JMP 010C0F9E
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!LoadLibraryW + 4 7C80AE6F 1 Byte [ 84 ]
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 010C001B
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 010C0F50
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 010C0FCA
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 010C0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 010C008E
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 010B0036
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 010B0062
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 010B0025
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 010B0FEF
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 010B0FA5
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 010B0FC0
.text C:\Program Files\McAfee\Common
 
nishikamae

Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 010B000A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 010B0047
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 01080000
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00710536
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] WS2_32.dll!send 71AB428A 5 Bytes JMP 007105E0
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00710553
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] wininet.dll!InternetOpenA 771CA6DD 5 Bytes JMP 0109000A
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] wininet.dll!InternetOpenW 771CAFC2 5 Bytes JMP 01090FE5
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] wininet.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 01090FD4
.text C:\Program Files\McAfee\Common Framework\naPrdMgr.exe[1632] wininet.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 01090025
.text C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe[1668] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009C0429
.text C:\WINDOWS\system32\nvsvc32.exe[1940] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00720429
.text C:\WINDOWS\system32\nvsvc32.exe[1940] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00720536
.text C:\WINDOWS\system32\nvsvc32.exe[1940] WS2_32.dll!send 71AB428A 5 Bytes JMP 007205E0
.text C:\WINDOWS\system32\nvsvc32.exe[1940] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00720553
.text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[1976] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A0429
.text C:\WINDOWS\System32\alg.exe[2088] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 005B0429
.text C:\WINDOWS\System32\alg.exe[2088] WS2_32.dll!connect 71AB406A 5 Bytes JMP 005B0536
.text C:\WINDOWS\System32\alg.exe[2088] WS2_32.dll!send 71AB428A 5 Bytes JMP 005B05E0
.text C:\WINDOWS\System32\alg.exe[2088] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 005B0553
.text C:\Program Files\iPod\bin\iPodService.exe[2736] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00690429
.text C:\Program Files\iTunes\iTunes.exe[2924] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003B0429
.text C:\Program Files\iTunes\iTunes.exe[2924] WS2_32.dll!connect 71AB406A 5 Bytes JMP 003B0536
.text C:\Program Files\iTunes\iTunes.exe[2924] WS2_32.dll!send 71AB428A 5 Bytes JMP 003B05E0
.text C:\Program Files\iTunes\iTunes.exe[2924] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003B0553
.text C:\WINDOWS\Explorer.EXE[3148] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00990429
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001A0000
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001A0087
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001A006C
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001A0F92
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001A0FAF
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001A0FC0
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001A0098
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001A0F50
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001A00D8
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001A0F35
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 001A0F1A
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 001A0051
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 001A001B
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 001A0F77
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 001A002C
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 001A0FDB
.text C:\WINDOWS\Explorer.EXE[3148] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 001A00B3
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 00290FC3
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 0029005E
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 0029000A
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 00290FDE
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 00290FA1
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 00290043
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 00290FEF
.text C:\WINDOWS\Explorer.EXE[3148] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 00290FB2
.text C:\WINDOWS\Explorer.EXE[3148] WININET.dll!InternetOpenA 771CA6DD 5 Bytes JMP 002C0FEF
.text C:\WINDOWS\Explorer.EXE[3148] WININET.dll!InternetOpenW 771CAFC2 5 Bytes JMP 002C0FDE
.text C:\WINDOWS\Explorer.EXE[3148] WININET.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 002C000A
.text C:\WINDOWS\Explorer.EXE[3148] WININET.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 002C0FB9
.text C:\WINDOWS\Explorer.EXE[3148] WS2_32.dll!socket 71AB3B91 5 Bytes JMP 015B0000
.text C:\WINDOWS\Explorer.EXE[3148] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00990536
.text C:\WINDOWS\Explorer.EXE[3148] WS2_32.dll!send 71AB428A 5 Bytes JMP 009905E0
.text C:\WINDOWS\Explorer.EXE[3148] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00990553
.text C:\WINDOWS\system32\wuauclt.exe[3224] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00880429
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateFileA 7C801A24 5 Bytes JMP 001B000A
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001B0082
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 001B0F97
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 001B0FA8
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 001B0FB9
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 001B0047
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 001B0F68
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 001B00B0
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001B00D2
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 001B0F39
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 001B00ED
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 001B0FCA
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateFileW 7C810780 5 Bytes JMP 001B0FE5
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 001B0093
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 001B0036
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 001B0025
.text C:\WINDOWS\system32\wuauclt.exe[3224] kernel32.dll!WinExec 7C8615B5 5 Bytes JMP 001B00C1
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 002B002C
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 002B0F91
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 002B001B
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 002B0FEF
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 002B004E
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 002B0FAC
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 002B000A
.text C:\WINDOWS\system32\wuauclt.exe[3224] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 002B003D
.text C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe[3516] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00890429
.text C:\Program Files\Multimedia Card Reader\shwicon2k.exe[3552] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A0429
.text C:\Program Files\McAfee\Common Framework\UdaterUI.exe[3560] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003B0429
.text C:\Program Files\McAfee\Common Framework\UdaterUI.exe[3560] WS2_32.dll!connect 71AB406A 5 Bytes JMP 003B0536
.text C:\Program Files\McAfee\Common Framework\UdaterUI.exe[3560] WS2_32.dll!send 71AB428A 5 Bytes JMP 003B05E0
.text C:\Program Files\McAfee\Common Framework\UdaterUI.exe[3560] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003B0553
.text C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe[3588] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003A0429
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00A20429
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreateFileA 7C801A24 5 Bytes JMP 00250FE5
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 00250058
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00250F63
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!LoadLibraryExW 7C801AF1 5 Bytes JMP 00250F7E
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!LoadLibraryExA 7C801D4F 5 Bytes JMP 00250047
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00250FA5
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!GetStartupInfoW 7C801E50 5 Bytes JMP 00250F1A
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!GetStartupInfoA 7C801EEE 5 Bytes JMP 00250F35
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 00250087
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00250EEE
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!GetProcAddress 7C80ADC0 5 Bytes JMP 00250ED3
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!LoadLibraryW 7C80AE6B 5 Bytes JMP 00250036
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll! 71AB3B91 5 Bytes JMP 01CE0FEF
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ws2_32.dll!connect 71AB406A 5
 
nishikamae

CreateFileW 7C810780 5 Bytes JMP 00250FCA
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreatePipe 7C81D7AF 5 Bytes JMP 00250F52
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreateNamedPipeW 7C82F034 5 Bytes JMP 0025001B
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!CreateNamedPipeA 7C85FE74 5 Bytes JMP 00250000
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] KERNEL32.dll!WinExec 7C8615B5 5 Bytes JMP 00250F09
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegOpenKeyExW 77DD6A78 5 Bytes JMP 003A0FC7
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegCreateKeyExW 77DD7535 5 Bytes JMP 003A0F80
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegOpenKeyExA 77DD761B 5 Bytes JMP 003A0022
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegOpenKeyW 77DD770F 5 Bytes JMP 003A0011
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegCreateKeyExA 77DDEAF4 5 Bytes JMP 003A0F91
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegCreateKeyW 77DF8F7D 5 Bytes JMP 003A0FAC
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegOpenKeyA 77DFC41B 5 Bytes JMP 003A0000
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ADVAPI32.dll!RegCreateKeyA 77DFD5BB 5 Bytes JMP 003A0033
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] WININET.dll!InternetOpenA 771CA6DD 5 Bytes JMP 01CB0FE5
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] WININET.dll!InternetOpenW 771CAFC2 5 Bytes JMP 01CB0FD4
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] WININET.dll!InternetOpenUrlA 771CC8BD 5 Bytes JMP 01CB0FB9
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] WININET.dll!InternetOpenUrlW 77215A51 5 Bytes JMP 01CB0FA8
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ws2_32.dll!socket

Bytes JMP 00A20536
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ws2_32.dll!send 71AB428A 5 Bytes JMP 00A205E0
.text C:\Program Files\SmartAdviser\EZAD\svchost.exe[3644] ws2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00A20553
.text C:\Program Files\QuickTime\QTTask.exe[3664] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009C0429
.text C:\Program Files\iTunes\iTunesHelper.exe[3676] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003C0429
.text C:\Program Files\iTunes\iTunesHelper.exe[3676] WS2_32.dll!connect 71AB406A 5 Bytes JMP 003C0536
.text C:\Program Files\iTunes\iTunesHelper.exe[3676] WS2_32.dll!send 71AB428A 5 Bytes JMP 003C05E0
.text C:\Program Files\iTunes\iTunesHelper.exe[3676] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003C0553
.text C:\Program Files\McAfee\Common Framework\McTray.exe[3704] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00990429
.text C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE[3740] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003A0429
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3780] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003A0429
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3780] WS2_32.dll!connect 71AB406A 5 Bytes JMP 003A0536
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3780] WS2_32.dll!send 71AB428A 5 Bytes JMP 003A05E0
.text C:\Program Files\Common Files\Real\Update_OB\realsched.exe[3780] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003A0553
.text C:\WINDOWS\system32\ctfmon.exe[3868] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00860429
.text C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe[3892] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 00E80429
.text C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe[3892] WS2_32.dll!connect 71AB406A 5 Bytes JMP 00E80536
.text C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe[3892] WS2_32.dll!send 71AB428A 5 Bytes JMP 00E805E0
.text C:\Program Files\Ashampoo\Ashampoo UnInstaller Platinum 2\UIWatcher.exe[3892] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 00E80553
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3928] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003D0429
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3928] WS2_32.dll!connect 71AB406A 5 Bytes JMP 003D0536
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3928] WS2_32.dll!send 71AB428A 5 Bytes JMP 003D05E0
.text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[3928] WS2_32.dll!WSAConnect 71AC0C69 5 Bytes JMP 003D0553
.text C:\Program Files\ViOrb\ViOrb.exe[3980] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 009A0429
.text C:\Program Files\ViStart\ViStart.exe[3992] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 003A0429

---- User IAT/EAT - GMER 1.0.13 ----

IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
IAT C:\WINDOWS\Explorer.EXE[3148] @ C:\WINDOWS\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress] [5CB77774] C:\WINDOWS\system32\ShimEng.dll
 
nishikamae

---- Devices - GMER 1.0.13 ----

Device \FileSystem\Ntfs \Ntfs IRP_MJ_READ 83B60908

AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [B8DDB0D1] mfehidk.sys
AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [B8DDB0D1] mfehidk.sys

Device \FileSystem\Fastfat \FatCdrom IRP_MJ_READ 8354E830

AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F7885AD0] mfetdik.sys
AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F7885AD0] mfetdik.sys

---- Modules - GMER 1.0.13 ----

Module _________ F763F000-F7657000 (98304 bytes)

---- EOF - GMER 1.0.13 ----
 
Hi

Scan this in jotti as before and post back results.

C:\Program Files\SmartAdviser\EZAD\svchost.exe
 
nishikamae

Scanner results
Scan taken on 16 Oct 2007 15:21:29 (GMT)
A-Squared Found nothing
AntiVir Found nothing
ArcaVir Found nothing
Avast Found nothing
AVG Antivirus Found nothing
BitDefender Found nothing
ClamAV Found nothing
CPsecure Found nothing
Dr.Web Found nothing
F-Prot Antivirus Found nothing
F-Secure Anti-Virus Found nothing
Fortinet Found nothing
Kaspersky Anti-Virus Found nothing
NOD32 Found nothing
Norman Virus Control Found nothing
Panda Antivirus Found nothing
Rising Antivirus Found nothing
Sophos Antivirus Found nothing
VirusBuster Found nothing
VBA32 Found nothing
 
Hi

Ok, then we leave it alone.

1. Please download The Avenger by Swandog46 to your Desktop.
  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop

2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):

Files to delete:
C:\WINDOWS\xlavra3.exe
C:\WINDOWS\dravic.exe
C:\WINDOWS\system32\lasse.exe

Registry values to replace with dummy:
HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows | AppInit_DLLs
Click to expand...

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply
 
nishikamae

while the avenger was running after reboot computer (not twice) on black command window it's had a pop up about can't reach the sourse drive or somthing i'm not sure tried 2 answer try again too many time but it did''t work so i answer continue 6 time and then the program creat a log file thank you

Here is a log file


Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\ebbsnsdv

*******************

Script file located at: \??\C:\WINDOWS\wggjebdq.txt
Script file opened successfully.

Script file read successfully

Backups directory opened successfully at C:\Avenger

*******************

Beginning to process script file:

File C:\WINDOWS\xlavra3.exe deleted successfully.
File C:\WINDOWS\dravic.exe deleted successfully.
File C:\WINDOWS\system32\lasse.exe deleted successfully.
Registry value HKLM\Software\Microsoft\Windows NT\CurrentVersion\Windows|AppInit_DLLs replaced with dummy successfully.

Completed script processing.

*******************

Finished! Terminate.
 
You must log in or register to reply here.
Back
Top