Highlighted
routeme2
1 Copper

IE Redirects

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:17:32 AM, on 4/27/2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\MozyPro\mozyprobackup.exe
C:\Program Files\PurgeIE\PurgeIE_Service.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\msiexec.exe
G:\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MaxtorOneTouch] C:\Program Files\Maxtor\OneTouch\utils\Onetouch.exe
O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [tblewhjg] C:\Documents and Settings\Owner\Local Settings\Application Data\irvkpxvtm\kgihmjttssd.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [tblewhjg] C:\Documents and Settings\Owner\Local Settings\Application Data\irvkpxvtm\kgihmjttssd.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: MozyPro Status.lnk = C:\Program Files\MozyPro\mozyprostat.exe
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1267743513437
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O23 - Service: Sony SPTI Service for DVE (ICDSPTSV) - Sony Corporation - C:\WINDOWS\system32\IcdSptSv.exe
O23 - Service: MaxBackServiceInt - Unknown owner - C:\Program Files\Maxtor\Maxtor Backup\MaxBackServiceInt.exe (file missing)
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: MozyPro Backup Service (mozyprobackup) - Mozy, Inc. - C:\Program Files\MozyPro\mozyprobackup.exe
O23 - Service: PurgeIE XP Service (PurgeIEservice) - Assistance & Resources for Computing, Inc. - C:\Program Files\PurgeIE\PurgeIE_Service.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6286 bytes

Tags (1)
0 Kudos
19 Replies
kevin27
4 Beryllium

Re: IE Redirects

Hi routeme2

Welcome to Dell Community Malware Removal Forums,

I'm K27 and i will be reviewing your log for you.

Please DO NOT run any scans/tools/fixes on your own as this will conflict with the tools we are going to use.

Please Print or Save to Notepad all instructions and please follow them carefully and if there's something you don't understand or that will not work please let me know and we will go through it together.


Please download Malwarebytes Anti-Malware and save it to your desktop.
alternate download link 1
alternate download link 2

MBAM may "make changes to your registry" as part of its disinfection routine. If using other security programs that detect registry changes (ie Spybot's Teatimer), they may interfere or alert you. Temporarily disable such programs or permit them to allow the changes.

  • Make sure you are connected to the Internet.
  • Double-click on mbam-setup.exe to install the application.
  • When the installation begins, follow the prompts and do not make any changes to default settings.
  • When installation has finished, make sure you leave both of these checked:
    • Update Malwarebytes' Anti-Malware
    • Launch Malwarebytes' Anti-Malware
  • Then click Finish.

MBAM will automatically start and you will be asked to update the program before performing a scan.

  • If an update is found, the program will automatically update itself. Press the OK button to close that box and continue.
  • If you encounter any problems while downloading the definition updates, manually download them from here and just double-click on mbam-rules.exe to install.

On the Scanner tab:

  • Make sure the "Perform Quick Scan" option is selected.
  • Then click on the Scan button.
  • If asked to select the drives to scan, leave all the drives selected and click on the Start Scan button.
  • The scan will begin and "Scan in progress" will show at the top. It may take some time to complete so please be patient.
  • When the scan is finished, a message box will say "The scan completed successfully. Click 'Show Results' to display all objects found".
  • Click OK to close the message box and continue with the removal process.

Back at the main Scanner screen:

  • Click on the Show Results button to see a list of any malware that was found.
  • Make sure that everything is checked, and click Remove Selected.
  • When removal is completed, a log report will open in Notepad.
  • The log is automatically saved and can be viewed by clicking the Logs tab in MBAM.
  • Copy and paste the contents of that report in your next reply. Be sure to post the complete log to include the top portion which shows MBAM's database version and your operating system.
  • Exit MBAM when done.

Note: If MBAM encounters a file that is difficult to remove, you will be asked to reboot your computer so MBAM can proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot normally (not into safe mode) will prevent MBAM from removing all the malware.

YOU MUST DISABLE ALL REAL TIME PROTECTION BEFORE RUNNING THE NEXT TOOL,

Next, download this Antirootkit Program to a folder that you create such as C:\ARK, by choosing the "Download EXE" button on the webpage.

Disable the active protection component of your antivirus and antispyware programs by following the directions that apply here:
http://www.bleepingcomputer.com/forums/topic114351.html

Next, please perform a rootkit scan:

  • Double-click the randomly name EXE located in the C:\ARK folder that you just downloaded to launch it
  • When the program opens, it will automatically initiate a very fast scan of common rootkit hiding places.
  • When the "quick" scan is finished (a few seconds), click the Rootkit/Malware tab,and then select the Scan button.
  • Leave your system completely idle while this longer scan is in progress.
  • When the scan is done, save the scan log to the Windows clipboard
  • Open Notepad or a similar text editor
  • Paste the clipboard contents into a text file by clicking Edit | Paste or Ctl V
  • Exit the Program
  • Save the Scan log as ARK.txt and post it in your next reply.
  • Now, re-enable the active protection component of any antivirus/antimalware programs you disabled before performing the scan.


If the ARK tool crashes your machine or causes a Blue Screen error, please post the log results from the first inital quick scan,this can be saved in the same way as the full scan in the above instructions.


Please post back the MBAM log and the ARK log, please remember that if the ARK tool crashes to please post the results from the quick scan.

Thanks
K27.

Malware Removal Staff at SpywareHammer

The Internet is the New Age Battle of the Old Age Clash Between Good and Evil

0 Kudos
routeme2
1 Copper

Re: IE Redirects

Thanks for picking this up K27.

MBAM only spotted the windows notification methods on av, firewall, and auto updates.

Logs follow.

Malwarebytes' Anti-Malware 1.46
www.malwarebytes.org

Database version: 4063

Windows 5.1.2600 Service Pack 3
Internet Explorer 6.0.2900.5512

5/3/2010 5:53:11 PM
mbam-log-2010-05-03 (17-53-11).txt

Scan type: Quick scan
Objects scanned: 128584
Time elapsed: 21 minute(s), 38 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 3
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

****************************************************************************************************

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-05-03 19:13:33
Windows 5.1.2600 Service Pack 3
Running: 05guimt5.exe; Driver: C:\DOCUME~1\Owner\LOCALS~1\Temp\uwtdapob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwConnectPort [0xF09988D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateFile [0xF09952D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateKey [0xF09A00D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreatePort [0xF0998C60]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateProcess [0xF099EEE0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateProcessEx [0xF099F110]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateSection [0xF09A26D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwCreateWaitablePort [0xF0998D40]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwDeleteFile [0xF0995950]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwDeleteKey [0xF09A10B0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwDeleteValueKey [0xF09A0D00]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwDuplicateObject [0xF099EC50]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwLoadKey [0xF09A13E0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwOpenFile [0xF09957A0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwOpenProcess [0xF099E9A0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwOpenThread [0xF099E7C0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwReplaceKey [0xF09A16D0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwRequestWaitReplyPort [0xF0998570]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwRestoreKey [0xF09A1980]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwSecureConnectPort [0xF0998A80]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwSetInformationFile [0xF0995AC0]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwSetValueKey [0xF09A0897]
SSDT            \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)                                                          ZwTerminateProcess [0xF099F340]

Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwMapViewOfSection [0xF916FCE0]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwOpenKey [0xF916FC3C]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwOpenProcess [0xF916FC14]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwOpenThread [0xF916FC28]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwSetSecurityObject [0xF916FCB6]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwUnmapViewOfSection [0xF916FCF6]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        ZwYieldExecution [0xF916FCCA]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        NtMapViewOfSection
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        NtOpenProcess
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        NtOpenThread
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                                                                                        NtSetSecurityObject

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 104                                                                                             804E2760 12 Bytes  [60, 8C, 99, F0, E0, EE, 99, ...]
.text           ntoskrnl.exe!_abnormal_termination + 234                                                                                             804E2890 4 Bytes  JMP 5F44192E
.text           ntoskrnl.exe!ZwYieldExecution                                                                                                        804F0EA6 7 Bytes  JMP F916FCCE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!ZwOpenKey                                                                                                               80568D59 5 Bytes  JMP F916FC40 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtOpenProcess                                                                                                           805717C7 5 Bytes  JMP F916FC18 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!ZwUnmapViewOfSection                                                                                                    805736E6 5 Bytes  JMP F916FCFA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtMapViewOfSection                                                                                                      80573B61 7 Bytes  JMP F916FCE4 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtOpenThread                                                                                                            8058A1C9 5 Bytes  JMP F916FC2C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtSetSecurityObject                                                                                                     8059B1AB 5 Bytes  JMP F916FCBA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!ZwRenameKey                                                                                                             8064E77C 7 Bytes  JMP F916FC7C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
?               eofzwce.sys                                                                                                                          The system cannot find the file specified. !
?               srescan.sys                                                                                                                          The system cannot find the file specified. !
.rsrc           C:\WINDOWS\System32\DRIVERS\i8042prt.sys                                                                                             entry point in ".rsrc" section [0xF93DC194]
.text           ntoskrnl.exe!_abnormal_termination + 104                                                                                             804E2760 12 Bytes  [60, 8C, 99, F0, E0, EE, 99, ...]
.text           ntoskrnl.exe!_abnormal_termination + 234                                                                                             804E2890 4 Bytes  JMP 5F44192E
.text           ntoskrnl.exe!KeSaveFloatingPointState + 11D                                                                                          804F0EA6 7 Bytes  JMP F916FCCE mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!ObOpenObjectByName + 95A                                                                                                80568D59 5 Bytes  JMP F916FC40 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtOpenProcess                                                                                                           805717C7 5 Bytes  JMP F916FC18 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!CcCopyRead + 663                                                                                                        805736E6 5 Bytes  JMP F916FCFA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtMapViewOfSection                                                                                                      80573B61 7 Bytes  JMP F916FCE4 mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtOpenThread                                                                                                            8058A1C9 5 Bytes  JMP F916FC2C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!NtSetSecurityObject                                                                                                     8059B1AB 5 Bytes  JMP F916FCBA mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
PAGE            ntoskrnl.exe!LsaDeregisterLogonProcess + 3D05                                                                                        8064E77C 7 Bytes  JMP F916FC7C mfehidk.sys (McAfee Link Driver/McAfee, Inc.)

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\System32\svchost.exe[384] ntdll.dll!NtCreateFile                                                                          7C90D0AE 5 Bytes  JMP 00AF0000
.text           C:\WINDOWS\System32\svchost.exe[384] ntdll.dll!NtCreateProcess                                                                       7C90D14E 5 Bytes  JMP 00AF0FE5
.text           C:\WINDOWS\System32\svchost.exe[384] ntdll.dll!NtProtectVirtualMemory                                                                7C90D6EE 5 Bytes  JMP 00AF0025
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateFileA                                                                        7C801A28 5 Bytes  JMP 00AE0000
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!VirtualProtectEx                                                                   7C801A61 5 Bytes  JMP 00AE0F63
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!VirtualProtect                                                                     7C801AD4 5 Bytes  JMP 00AE0F74
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!LoadLibraryExW                                                                     7C801AF5 5 Bytes  JMP 00AE0F8F
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!LoadLibraryExA                                                                     7C801D53 5 Bytes  JMP 00AE0058
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!LoadLibraryA                                                                       7C801D7B 5 Bytes  JMP 00AE0FC0
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!GetStartupInfoW                                                                    7C801E54 5 Bytes  JMP 00AE00AB
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!GetStartupInfoA                                                                    7C801EF2 5 Bytes  JMP 00AE0084
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateProcessW                                                                     7C802336 5 Bytes  JMP 00AE0F2D
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateProcessA                                                                     7C80236B 5 Bytes  JMP 00AE00C6
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!GetProcAddress                                                                     7C80AE40 5 Bytes  JMP 00AE00E1
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!LoadLibraryW                                                                       7C80AEEB 5 Bytes  JMP 00AE0047
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateFileW                                                                        7C810800 5 Bytes  JMP 00AE001B
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreatePipe                                                                         7C81D83F 5 Bytes  JMP 00AE0073
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateNamedPipeW                                                                   7C82F0DD 5 Bytes  JMP 00AE0FDB
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!CreateNamedPipeA                                                                   7C860CDC 5 Bytes  JMP 00AE002C
.text           C:\WINDOWS\System32\svchost.exe[384] kernel32.dll!WinExec                                                                            7C86250D 5 Bytes  JMP 00AE0F48
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegOpenKeyExW                                                                      77DD6AAF 5 Bytes  JMP 007F0036
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegCreateKeyExW                                                                    77DD776C 5 Bytes  JMP 007F0FAF
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegOpenKeyExA                                                                      77DD7852 5 Bytes  JMP 007F0FE5
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegOpenKeyW                                                                        77DD7946 5 Bytes  JMP 007F001B
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegCreateKeyExA                                                                    77DDE9F4 5 Bytes  JMP 007F0FC0
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegOpenKeyA                                                                        77DDEFC8 5 Bytes  JMP 007F0000
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegCreateKeyW                                                                      77DFBA55 5 Bytes  JMP 007F0058
.text           C:\WINDOWS\System32\svchost.exe[384] ADVAPI32.dll!RegCreateKeyA                                                                      77DFBCF3 5 Bytes  JMP 007F0047
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!_wsystem                                                                             77C2931E 5 Bytes  JMP 007E0FB2
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!system                                                                               77C293C7 5 Bytes  JMP 007E003D
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!_creat                                                                               77C2D40F 5 Bytes  JMP 007E0FD7
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!_open                                                                                77C2F566 5 Bytes  JMP 007E0000
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!_wcreat                                                                              77C2FC9B 5 Bytes  JMP 007E002C
.text           C:\WINDOWS\System32\svchost.exe[384] msvcrt.dll!_wopen                                                                               77C30055 5 Bytes  JMP 007E0011
.text           C:\WINDOWS\System32\svchost.exe[384] WININET.dll!InternetOpenW                                                                       771BAF45 5 Bytes  JMP 007D001B
.text           C:\WINDOWS\System32\svchost.exe[384] WININET.dll!InternetOpenA                                                                       771C5796 5 Bytes  JMP 007D000A
.text           C:\WINDOWS\System32\svchost.exe[384] WININET.dll!InternetOpenUrlA                                                                    771C5A62 5 Bytes  JMP 007D0FE3
.text           C:\WINDOWS\System32\svchost.exe[384] WININET.dll!InternetOpenUrlW                                                                    771D5BB2 5 Bytes  JMP 007D0FD2
.text           C:\WINDOWS\system32\services.exe[1100] ntdll.dll!NtCreateFile                                                                        7C90D0AE 5 Bytes  JMP 0080000A
.text           C:\WINDOWS\system32\services.exe[1100] ntdll.dll!NtCreateProcess                                                                     7C90D14E 5 Bytes  JMP 0080001B
.text           C:\WINDOWS\system32\services.exe[1100] ntdll.dll!NtProtectVirtualMemory                                                              7C90D6EE 5 Bytes  JMP 00800FEF
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateFileA                                                                      7C801A28 5 Bytes  JMP 003B0FE5
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!VirtualProtectEx                                                                 7C801A61 1 Byte  [E9]
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!VirtualProtectEx                                                                 7C801A61 5 Bytes  JMP 003B0065
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!VirtualProtect                                                                   7C801AD4 5 Bytes  JMP 003B004A
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!LoadLibraryExW                                                                   7C801AF5 5 Bytes  JMP 003B0F7C
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!LoadLibraryExA                                                                   7C801D53 5 Bytes  JMP 003B0F8D
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!LoadLibraryA                                                                     7C801D7B 5 Bytes  JMP 003B0FB2
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!GetStartupInfoW                                                                  7C801E54 5 Bytes  JMP 003B0093
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!GetStartupInfoA                                                                  7C801EF2 5 Bytes  JMP 003B0F4B
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateProcessW                                                                   7C802336 5 Bytes  JMP 003B0F1F
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateProcessA                                                                   7C80236B 5 Bytes  JMP 003B00B8
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!GetProcAddress                                                                   7C80AE40 5 Bytes  JMP 003B0F0E
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!LoadLibraryW                                                                     7C80AEEB 5 Bytes  JMP 003B0039
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateFileW                                                                      7C810800 5 Bytes  JMP 003B0FD4
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreatePipe                                                                       7C81D83F 5 Bytes  JMP 003B0076
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateNamedPipeW                                                                 7C82F0DD 5 Bytes  JMP 003B0FC3
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!CreateNamedPipeA                                                                 7C860CDC 5 Bytes  JMP 003B0014
.text           C:\WINDOWS\system32\services.exe[1100] kernel32.dll!WinExec                                                                          7C86250D 5 Bytes  JMP 003B0F30
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegOpenKeyExW                                                                    77DD6AAF 5 Bytes  JMP 00070FB9
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegCreateKeyExW                                                                  77DD776C 5 Bytes  JMP 00070F61
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegOpenKeyExA                                                                    77DD7852 5 Bytes  JMP 00070FD4
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegOpenKeyW                                                                      77DD7946 5 Bytes  JMP 0007000A
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegCreateKeyExA                                                                  77DDE9F4 5 Bytes  JMP 00070F72
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegOpenKeyA                                                                      77DDEFC8 5 Bytes  JMP 00070FEF
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegCreateKeyW                                                                    77DFBA55 2 Bytes  JMP 00070F8D
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegCreateKeyW + 3                                                                77DFBA58 2 Bytes  [27, 88]
.text           C:\WINDOWS\system32\services.exe[1100] ADVAPI32.dll!RegCreateKeyA                                                                    77DFBCF3 5 Bytes  JMP 00070FA8
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!_wsystem                                                                           77C2931E 5 Bytes  JMP 00060F90
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!system                                                                             77C293C7 5 Bytes  JMP 00060FAB
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!_creat                                                                             77C2D40F 5 Bytes  JMP 00060011
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!_open                                                                              77C2F566 5 Bytes  JMP 00060FE3
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!_wcreat                                                                            77C2FC9B 5 Bytes  JMP 00060FBC
.text           C:\WINDOWS\system32\services.exe[1100] msvcrt.dll!_wopen                                                                             77C30055 5 Bytes  JMP 00060000
.text           C:\WINDOWS\system32\services.exe[1100] WININET.dll!InternetOpenW                                                                     771BAF45 5 Bytes  JMP 0005000A
.text           C:\WINDOWS\system32\services.exe[1100] WININET.dll!InternetOpenA                                                                     771C5796 5 Bytes  JMP 00050FE5
.text           C:\WINDOWS\system32\services.exe[1100] WININET.dll!InternetOpenUrlA                                                                  771C5A62 5 Bytes  JMP 00050FD4
.text           C:\WINDOWS\system32\services.exe[1100] WININET.dll!InternetOpenUrlW                                                                  771D5BB2 5 Bytes  JMP 00050027
.text           C:\WINDOWS\system32\services.exe[1100] WS2_32.dll!socket                                                                             71AB4211 5 Bytes  JMP 00040FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] ntdll.dll!NtCreateFile                                                                           7C90D0AE 5 Bytes  JMP 00FB0FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] ntdll.dll!NtCreateProcess                                                                        7C90D14E 5 Bytes  JMP 00FB0000
.text           C:\WINDOWS\system32\lsass.exe[1112] ntdll.dll!NtProtectVirtualMemory                                                                 7C90D6EE 5 Bytes  JMP 00FB0FD4
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateFileA                                                                         7C801A28 5 Bytes  JMP 00FA0FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!VirtualProtectEx                                                                    7C801A61 5 Bytes  JMP 00FA0F72
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!VirtualProtect                                                                      7C801AD4 5 Bytes  JMP 00FA0F8D
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!LoadLibraryExW                                                                      7C801AF5 5 Bytes  JMP 00FA0F9E
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!LoadLibraryExA                                                                      7C801D53 5 Bytes  JMP 00FA005B
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!LoadLibraryA                                                                        7C801D7B 5 Bytes  JMP 00FA0FB9
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!GetStartupInfoW                                                                     7C801E54 5 Bytes  JMP 00FA00C4
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!GetStartupInfoA                                                                     7C801EF2 5 Bytes  JMP 00FA009D
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateProcessW                                                                      7C802336 5 Bytes  JMP 00FA00F0
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateProcessA                                                                      7C80236B 5 Bytes  JMP 00FA0F61
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!GetProcAddress                                                                      7C80AE40 5 Bytes  JMP 00FA0101
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!LoadLibraryW                                                                        7C80AEEB 5 Bytes  JMP 00FA0040
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateFileW                                                                         7C810800 5 Bytes  JMP 00FA000A
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreatePipe                                                                          7C81D83F 5 Bytes  JMP 00FA0082
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateNamedPipeW                                                                    7C82F0DD 5 Bytes  JMP 00FA0FCA
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!CreateNamedPipeA                                                                    7C860CDC 5 Bytes  JMP 00FA001B
.text           C:\WINDOWS\system32\lsass.exe[1112] kernel32.dll!WinExec                                                                             7C86250D 5 Bytes  JMP 00FA00D5
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegOpenKeyExW                                                                       77DD6AAF 5 Bytes  JMP 00D8001E
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegCreateKeyExW                                                                     77DD776C 5 Bytes  JMP 00D80F8D
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegOpenKeyExA                                                                       77DD7852 5 Bytes  JMP 00D80FCD
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegOpenKeyW                                                                         77DD7946 5 Bytes  JMP 00D80FDE
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegCreateKeyExA                                                                     77DDE9F4 5 Bytes  JMP 00D8004A
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegOpenKeyA                                                                         77DDEFC8 5 Bytes  JMP 00D80FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegCreateKeyW                                                                       77DFBA55 5 Bytes  JMP 00D80039
.text           C:\WINDOWS\system32\lsass.exe[1112] ADVAPI32.dll!RegCreateKeyA                                                                       77DFBCF3 5 Bytes  JMP 00D80FB2
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!_wsystem                                                                              77C2931E 5 Bytes  JMP 00D70038
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!system                                                                                77C293C7 5 Bytes  JMP 00D70027
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!_creat                                                                                77C2D40F 5 Bytes  JMP 00D7000C
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!_open                                                                                 77C2F566 5 Bytes  JMP 00D70FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!_wcreat                                                                               77C2FC9B 5 Bytes  JMP 00D70FB7
.text           C:\WINDOWS\system32\lsass.exe[1112] msvcrt.dll!_wopen                                                                                77C30055 5 Bytes  JMP 00D70FD2
.text           C:\WINDOWS\system32\lsass.exe[1112] WS2_32.dll!socket                                                                                71AB4211 5 Bytes  JMP 00D50000
.text           C:\WINDOWS\system32\lsass.exe[1112] WININET.dll!InternetOpenW                                                                        771BAF45 5 Bytes  JMP 00D60FEF
.text           C:\WINDOWS\system32\lsass.exe[1112] WININET.dll!InternetOpenA                                                                        771C5796 5 Bytes  JMP 00D6000A
.text           C:\WINDOWS\system32\lsass.exe[1112] WININET.dll!InternetOpenUrlA                                                                     771C5A62 5 Bytes  JMP 00D60025
.text           C:\WINDOWS\system32\lsass.exe[1112] WININET.dll!InternetOpenUrlW                                                                     771D5BB2 5 Bytes  JMP 00D60040
.text           C:\WINDOWS\system32\svchost.exe[1268] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 00FF0FE5
.text           C:\WINDOWS\system32\svchost.exe[1268] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 00FF0FC3
.text           C:\WINDOWS\system32\svchost.exe[1268] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 00FF0FD4
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 00FE0FEF
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 00FE00B8
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 00FE009D
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 00FE008C
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 00FE0FC3
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 00FE004A
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 00FE0F8B
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 00FE0FA8
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 00FE0109
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 00FE0F66
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 00FE011A
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 00FE005B
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 00FE0FDE
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 00FE00D3
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 00FE002F
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 00FE001E
.text           C:\WINDOWS\system32\svchost.exe[1268] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 00FE00E4
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 00FD002C
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 00FD008E
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 00FD001B
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 00FD0FE5
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 00FD007D
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 00FD0000
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 5 Bytes  JMP 00FD0062
.text           C:\WINDOWS\system32\svchost.exe[1268] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 00FD0047
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 00FC0FBC
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 00FC0047
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 00FC002C
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 00FC0000
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 00FC0FCD
.text           C:\WINDOWS\system32\svchost.exe[1268] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 00FC0011
.text           C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 00FB0011
.text           C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 00FB0000
.text           C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 00FB0FDB
.text           C:\WINDOWS\system32\svchost.exe[1268] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 00FB002E
.text           C:\WINDOWS\system32\svchost.exe[1268] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 00FA0FE5
.text           C:\WINDOWS\system32\svchost.exe[1340] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 00CA0FEF
.text           C:\WINDOWS\system32\svchost.exe[1340] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 00CA0FC3
.text           C:\WINDOWS\system32\svchost.exe[1340] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 00CA0FD4
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 00C90FE5
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 00C900A4
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 00C90093
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 00C9006C
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 00C9005B
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 00C90040
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 00C900DA
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 00C900C9
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 00C9011A
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 00C90F81
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 00C90F66
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 00C90FB9
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 00C9000A
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 00C90F9E
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 00C90025
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 00C90FD4
.text           C:\WINDOWS\system32\svchost.exe[1340] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 00C900FF
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 00C8001B
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 00C80058
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 00C80FD4
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 00C8000A
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 00C80FA5
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 00C80FEF
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 5 Bytes  JMP 00C8003D
.text           C:\WINDOWS\system32\svchost.exe[1340] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 00C8002C
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 00C70FCD
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 00C7004E
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 00C70029
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 00C70000
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 00C70FDE
.text           C:\WINDOWS\system32\svchost.exe[1340] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 00C70FEF
.text           C:\WINDOWS\system32\svchost.exe[1340] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 00C6000A
.text           C:\WINDOWS\system32\svchost.exe[1340] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 00C60FEF
.text           C:\WINDOWS\system32\svchost.exe[1340] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 00C6001B
.text           C:\WINDOWS\system32\svchost.exe[1340] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 00C6002C
.text           C:\WINDOWS\system32\svchost.exe[1340] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 007F000A
.text           C:\WINDOWS\System32\svchost.exe[1464] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 03270000
.text           C:\WINDOWS\System32\svchost.exe[1464] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 0327001B
.text           C:\WINDOWS\System32\svchost.exe[1464] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 03270FE5
.text           C:\WINDOWS\System32\svchost.exe[1464] ntdll.dll!NtWriteVirtualMemory                                                                 7C90DFAE 5 Bytes  JMP 007B000A
.text           C:\WINDOWS\System32\svchost.exe[1464] ntdll.dll!KiUserExceptionDispatcher                                                            7C90E47C 5 Bytes  JMP 0079000C
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 0326000A
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 03260F6D
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 03260062
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 03260F94
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 03260051
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 03260FD4
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 03260098
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 0326007D
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 032600DF
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 032600CE
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 03260F35
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 03260FAF
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 03260FEF
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 03260F52
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 03260040
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 0326002F
.text           C:\WINDOWS\System32\svchost.exe[1464] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 032600A9
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 02DD0FE5
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 02DD006C
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 02DD002C
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 02DD0011
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 02DD0FAF
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 02DD0000
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 2 Bytes  JMP 02DD0FCA
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyW + 3                                                                 77DFBA58 2 Bytes  [FD, 8A]
.text           C:\WINDOWS\System32\svchost.exe[1464] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 02DD0051
.text           C:\WINDOWS\System32\svchost.exe[1464] USER32.dll!GetCursorPos                                                                        7E42974E 5 Bytes  JMP 02DB000A
.text           C:\WINDOWS\System32\svchost.exe[1464] ole32.dll!CoCreateInstance                                                                     7750057E 5 Bytes  JMP 02DA000A
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 03250053
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 03250038
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 0325001D
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 03250FEF
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 03250FC8
.text           C:\WINDOWS\System32\svchost.exe[1464] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 0325000C
.text           C:\WINDOWS\System32\svchost.exe[1464] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 02DC0000
.text           C:\WINDOWS\System32\svchost.exe[1464] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 02DC0FEF
.text           C:\WINDOWS\System32\svchost.exe[1464] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 02DC001D
.text           C:\WINDOWS\System32\svchost.exe[1464] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 02DC002E
.text           C:\WINDOWS\System32\svchost.exe[1464] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 029C0FEF
.text           C:\WINDOWS\System32\svchost.exe[1568] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 00A30000
.text           C:\WINDOWS\System32\svchost.exe[1568] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 00A30FD4
.text           C:\WINDOWS\System32\svchost.exe[1568] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 00A30FE5
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 00A20000
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 00A20F6B
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 00A20F7C
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 00A20F8D
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 00A20F9E
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 00A20040
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 00A20F29
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 00A20071
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 00A200BB
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 00A200A0
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 00A200CC
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 00A20FB9
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 00A20011
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 00A20F46
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 00A20FD4
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 00A20FE5
.text           C:\WINDOWS\System32\svchost.exe[1568] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 00A20F18
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 00A10FCA
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 00A10076
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 00A10FDB
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 00A10011
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 00A1005B
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 00A10000
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 2 Bytes  JMP 00A10FB9
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyW + 3                                                                 77DFBA58 2 Bytes  [C1, 88]
.text           C:\WINDOWS\System32\svchost.exe[1568] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 00A10040
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 007F0042
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 007F0027
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 007F0FC8
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 007F0FEF
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 007F0FB7
.text           C:\WINDOWS\System32\svchost.exe[1568] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 007F000C
.text           C:\WINDOWS\System32\svchost.exe[1568] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 007E001B
.text           C:\WINDOWS\System32\svchost.exe[1568] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 007E0000
.text           C:\WINDOWS\System32\svchost.exe[1568] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 007E0FEF
.text           C:\WINDOWS\System32\svchost.exe[1568] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 007E0FDE
.text           C:\WINDOWS\System32\svchost.exe[1568] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 007D0FEF
.text           C:\WINDOWS\System32\svchost.exe[1576] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 007F0FEF
.text           C:\WINDOWS\System32\svchost.exe[1576] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 007F0FD4
.text           C:\WINDOWS\System32\svchost.exe[1576] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 007F000A
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 007E0000
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 007E0F91
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 007E0086
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 007E0069
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 007E0058
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 007E0FB6
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 007E00A1
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 007E0F65
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 007E0F34
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 007E00C3
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 007E00E8
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 007E003D
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 007E0FE5
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 007E0F76
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 007E002C
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 007E001B
.text           C:\WINDOWS\System32\svchost.exe[1576] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 007E00B2
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 00780022
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 00780F87
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 00780FDB
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 00780011
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 00780FA2
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 00780000
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 5 Bytes  JMP 00780044
.text           C:\WINDOWS\System32\svchost.exe[1576] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 00780033
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 00770049
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 00770FBE
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 00770FE3
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 0077000C
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 0077002E
.text           C:\WINDOWS\System32\svchost.exe[1576] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 0077001D
.text           C:\WINDOWS\System32\svchost.exe[1576] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 0076000A
.text           C:\WINDOWS\System32\svchost.exe[1576] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 00760FE5
.text           C:\WINDOWS\System32\svchost.exe[1576] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 00760FD4
.text           C:\WINDOWS\System32\svchost.exe[1576] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 00760027
.text           C:\WINDOWS\System32\svchost.exe[1576] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 00750FEF
.text           C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[1688] kernel32.dll!LoadLibraryA                                          7C801D7B 5 Bytes  JMP 62419A20 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text           C:\Program Files\Common Files\McAfee\McSvcHost\McSvHost.exe[1688] kernel32.dll!LoadLibraryW                                          7C80AEEB 5 Bytes  JMP 62419AE2 C:\Program Files\Common Files\McAfee\McProxy\mcproxy.dll (McAfee Proxy Service Module/McAfee, Inc.)
.text           C:\WINDOWS\system32\svchost.exe[1744] ntdll.dll!NtCreateFile                                                                         7C90D0AE 5 Bytes  JMP 00CC0FE5
.text           C:\WINDOWS\system32\svchost.exe[1744] ntdll.dll!NtCreateProcess                                                                      7C90D14E 5 Bytes  JMP 00CC0FCA
.text           C:\WINDOWS\system32\svchost.exe[1744] ntdll.dll!NtProtectVirtualMemory                                                               7C90D6EE 5 Bytes  JMP 00CC0000
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateFileA                                                                       7C801A28 5 Bytes  JMP 00CB0FEF
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!VirtualProtectEx                                                                  7C801A61 5 Bytes  JMP 00CB0060
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!VirtualProtect                                                                    7C801AD4 5 Bytes  JMP 00CB0F6B
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!LoadLibraryExW                                                                    7C801AF5 5 Bytes  JMP 00CB0F7C
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!LoadLibraryExA                                                                    7C801D53 5 Bytes  JMP 00CB0F8D
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!LoadLibraryA                                                                      7C801D7B 5 Bytes  JMP 00CB0FB9
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!GetStartupInfoW                                                                   7C801E54 5 Bytes  JMP 00CB0F29
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!GetStartupInfoA                                                                   7C801EF2 5 Bytes  JMP 00CB0071
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateProcessW                                                                    7C802336 5 Bytes  JMP 00CB0ED8
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateProcessA                                                                    7C80236B 5 Bytes  JMP 00CB0EF3
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!GetProcAddress                                                                    7C80AE40 5 Bytes  JMP 00CB0096
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!LoadLibraryW                                                                      7C80AEEB 5 Bytes  JMP 00CB0F9E
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateFileW                                                                       7C810800 5 Bytes  JMP 00CB0FD4
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreatePipe                                                                        7C81D83F 5 Bytes  JMP 00CB0F46
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateNamedPipeW                                                                  7C82F0DD 5 Bytes  JMP 00CB0025
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!CreateNamedPipeA                                                                  7C860CDC 5 Bytes  JMP 00CB0014
.text           C:\WINDOWS\system32\svchost.exe[1744] kernel32.dll!WinExec                                                                           7C86250D 5 Bytes  JMP 00CB0F18
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegOpenKeyExW                                                                     77DD6AAF 5 Bytes  JMP 00CA002C
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegCreateKeyExW                                                                   77DD776C 5 Bytes  JMP 00CA0058
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegOpenKeyExA                                                                     77DD7852 5 Bytes  JMP 00CA001B
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegOpenKeyW                                                                       77DD7946 5 Bytes  JMP 00CA000A
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegCreateKeyExA                                                                   77DDE9F4 5 Bytes  JMP 00CA0047
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegOpenKeyA                                                                       77DDEFC8 5 Bytes  JMP 00CA0FEF
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegCreateKeyW                                                                     77DFBA55 2 Bytes  JMP 00CA0F9B
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegCreateKeyW + 3                                                                 77DFBA58 2 Bytes  JMP 50C03388
.text           C:\WINDOWS\system32\svchost.exe[1744] ADVAPI32.dll!RegCreateKeyA                                                                     77DFBCF3 5 Bytes  JMP 00CA0FB6
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!_wsystem                                                                            77C2931E 5 Bytes  JMP 007F001D
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!system                                                                              77C293C7 5 Bytes  JMP 007F000C
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!_creat                                                                              77C2D40F 5 Bytes  JMP 007F0FB7
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!_open                                                                               77C2F566 5 Bytes  JMP 007F0FE3
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!_wcreat                                                                             77C2FC9B 5 Bytes  JMP 007F0FA6
.text           C:\WINDOWS\system32\svchost.exe[1744] msvcrt.dll!_wopen                                                                              77C30055 5 Bytes  JMP 007F0FD2
.text           C:\WINDOWS\system32\svchost.exe[1744] WININET.dll!InternetOpenW                                                                      771BAF45 5 Bytes  JMP 007E0FDE
.text           C:\WINDOWS\system32\svchost.exe[1744] WININET.dll!InternetOpenA                                                                      771C5796 5 Bytes  JMP 007E0FEF
.text           C:\WINDOWS\system32\svchost.exe[1744] WININET.dll!InternetOpenUrlA                                                                   771C5A62 5 Bytes  JMP 007E0FCD
.text           C:\WINDOWS\system32\svchost.exe[1744] WININET.dll!InternetOpenUrlW                                                                   771D5BB2 5 Bytes  JMP 007E0FBC
.text           C:\WINDOWS\system32\svchost.exe[1744] WS2_32.dll!socket                                                                              71AB4211 5 Bytes  JMP 007D0FEF
.text           C:\WINDOWS\Explorer.EXE[1972] ntdll.dll!NtCreateFile                                                                                 7C90D0AE 5 Bytes  JMP 02AE000A
.text           C:\WINDOWS\Explorer.EXE[1972] ntdll.dll!NtCreateProcess                                                                              7C90D14E 5 Bytes  JMP 02AE0FD4
.text           C:\WINDOWS\Explorer.EXE[1972] ntdll.dll!NtProtectVirtualMemory                                                                       7C90D6EE 5 Bytes  JMP 02AE0FE5
.text           C:\WINDOWS\Explorer.EXE[1972] ntdll.dll!NtWriteVirtualMemory                                                                         7C90DFAE 5 Bytes  JMP 00A7000A
.text           C:\WINDOWS\Explorer.EXE[1972] ntdll.dll!KiUserExceptionDispatcher                                                                    7C90E47C 5 Bytes  JMP 00A0000C
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateFileA                                                                               7C801A28 5 Bytes  JMP 02AD0000
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!VirtualProtectEx                                                                          7C801A61 5 Bytes  JMP 02AD0F52
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!VirtualProtect                                                                            7C801AD4 5 Bytes  JMP 02AD0F63
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!LoadLibraryExW                                                                            7C801AF5 5 Bytes  JMP 02AD0F74
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!LoadLibraryExA                                                                            7C801D53 5 Bytes  JMP 02AD003D
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!LoadLibraryA                                                                              7C801D7B 5 Bytes  JMP 02AD0FAF
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!GetStartupInfoW                                                                           7C801E54 5 Bytes  JMP 02AD0F1A
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!GetStartupInfoA                                                                           7C801EF2 5 Bytes  JMP 02AD0F37
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateProcessW                                                                            7C802336 5 Bytes  JMP 02AD0EDA
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateProcessA                                                                            7C80236B 5 Bytes  JMP 02AD0EF5
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!GetProcAddress                                                                            7C80AE40 5 Bytes  JMP 02AD008E
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!LoadLibraryW                                                                              7C80AEEB 5 Bytes  JMP 02AD002C
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateFileW                                                                               7C810800 5 Bytes  JMP 02AD0FE5
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreatePipe                                                                                7C81D83F 5 Bytes  JMP 02AD0062
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateNamedPipeW                                                                          7C82F0DD 5 Bytes  JMP 02AD001B
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!CreateNamedPipeA                                                                          7C860CDC 5 Bytes  JMP 02AD0FCA
.text           C:\WINDOWS\Explorer.EXE[1972] kernel32.dll!WinExec                                                                                   7C86250D 5 Bytes  JMP 02AD0073
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegOpenKeyExW                                                                             77DD6AAF 5 Bytes  JMP 02A70FD4
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegCreateKeyExW                                                                           77DD776C 5 Bytes  JMP 02A70076
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegOpenKeyExA                                                                             77DD7852 5 Bytes  JMP 02A70FE5
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegOpenKeyW                                                                               77DD7946 5 Bytes  JMP 02A7001B
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegCreateKeyExA                                                                           77DDE9F4 5 Bytes  JMP 02A70065
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegOpenKeyA                                                                               77DDEFC8 5 Bytes  JMP 02A7000A
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegCreateKeyW                                                                             77DFBA55 5 Bytes  JMP 02A70040
.text           C:\WINDOWS\Explorer.EXE[1972] ADVAPI32.dll!RegCreateKeyA                                                                             77DFBCF3 5 Bytes  JMP 02A70FB9
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!_wsystem                                                                                    77C2931E 5 Bytes  JMP 02A60FCA
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!system                                                                                      77C293C7 5 Bytes  JMP 02A60FE5
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!_creat                                                                                      77C2D40F 5 Bytes  JMP 02A60044
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!_open                                                                                       77C2F566 5 Bytes  JMP 02A6000C
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!_wcreat                                                                                     77C2FC9B 5 Bytes  JMP 02A60055
.text           C:\WINDOWS\Explorer.EXE[1972] msvcrt.dll!_wopen                                                                                      77C30055 5 Bytes  JMP 02A6001D
.text           C:\WINDOWS\Explorer.EXE[1972] WININET.dll!InternetOpenW                                                                              771BAF45 5 Bytes  JMP 028C0014
.text           C:\WINDOWS\Explorer.EXE[1972] WININET.dll!InternetOpenA                                                                              771C5796 5 Bytes  JMP 028C0FEF
.text           C:\WINDOWS\Explorer.EXE[1972] WININET.dll!InternetOpenUrlA                                                                           771C5A62 5 Bytes  JMP 028C0025
.text           C:\WINDOWS\Explorer.EXE[1972] WININET.dll!InternetOpenUrlW                                                                           771D5BB2 5 Bytes  JMP 028C0FD2
.text           C:\WINDOWS\Explorer.EXE[1972] WS2_32.dll!socket                                                                                      71AB4211 5 Bytes  JMP 02260FEF

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol]                                                             [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter]                                                                  [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter]                                                                 [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol]                                                           [F099D550] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol]                                                             [F099D550] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol]                                                               [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter]                                                                    [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter]                                                                   [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol]                                                              [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol]                                                            [F099D550] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter]                                                                  [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter]                                                                   [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter]                                                                    [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter]                                                                     [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol]                                                                [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile]                                                                      [F09AA9B0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol]                                                             [F099D550] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol]                                                               [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter]                                                                    [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter]                                                                   [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol]                                                              [F099D3E0] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol]                                                            [F099D550] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter]                                                                  [F099DA60] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter]                                                                   [F099D900] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile]                                                              [F0995F70] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile]                                                                      [F0996120] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile]                                                                      [F0995C80] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)
IAT             \SystemRoot\System32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile]                                                                        [F0996020] \SystemRoot\System32\vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe[1780] @ C:\WINDOWS\system32\CRYPT32.dll [ADVAPI32.dll!RegQueryValueExW]  [004076E0] C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)
IAT             C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe[1780] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA]      [00407740] C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe (McAfee Process Validation Service/McAfee, Inc.)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                               mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                               mozypro.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)

Device          \Driver\Tcpip \Device\Ip                                                                                                             vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                             mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\Tcp                                                                                                            vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                            mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\Udp                                                                                                            vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                            mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\RawIp                                                                                                          vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                          mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

Device          \Driver\Tcpip \Device\IPMULTICAST                                                                                                    vsdatant.sys (TrueVector Device Driver/Zone Labs, LLC)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                             mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                             mozypro.sys (Mozy Change Monitor Filter Driver/Mozy, Inc.)

Device           -> \Driver\atapi \Device\Harddisk0\DR0                                                                                              FFB79EE4

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                                                   15
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                                                      10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                                                    yes
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                                                  
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                                                   90
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                                                     10000

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\System32\DRIVERS\i8042prt.sys                                                                                             suspicious modification
File            C:\WINDOWS\system32\drivers\atapi.sys                                                                                                suspicious modification

---- EOF - GMER 1.0.15 ----

 

0 Kudos
kevin27
4 Beryllium

Re: IE Redirects

Hi,

You have a pretty nasty Rootkit infection called TDL3
We can clean it but we have a bit of work to do.

PLEASE BE SURE TO DISABLE ALL PROTECTIVE SOFTWARE THAT IS RUNNING ON YOUR MACHINE BEFORE RUNNING COMBO-FIX, SO THAT COMBO-FIX IS NOT HINDERED IN ITS REMOVAL PROCESS

Please:

  • Disable all Anti-virus/Anti-Spyware/FireWall on your machine(instructions via links below)
  • Anti Virus
  • Anti Spyware
  • If you have trouble disabling your firewall please post back before continuning which one you use and I will give you the instructioins.
(If its a third party Firewall there should be a Icon on your task bar by the clock, right click that and choose Disable/Stop. If its the Windows built-in firewall you should be able to disable it via Control Panel.



Please download ComboFix.exe. Please visit THIS webpage for download links, and instructions for running the tool:

Combo-fix MUST be save to your desktop before running the tool

5> * Ensure you have disabled all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

When prompted to install the recovery console please make sure to do so as the is a VERY IMPORTANT backup of Combo-fix XP only

You will need to be conected to the net to install the recovery console, if you can not install it DO NOT run Combo-Fix,
Post back and we will install it manually.

DO NOT mouse click when Combo-Fix is running as this will cause Combo-Fix to Stall and it will not work as it should

Please include the C:\ComboFix.txt in your next reply for further review.


Thanks

Malware Removal Staff at SpywareHammer

The Internet is the New Age Battle of the Old Age Clash Between Good and Evil

0 Kudos
routeme2
1 Copper

Re: IE Redirects

ComboFix seemed to run fine. 

I have seen a file called PEV coming and going in C:\Windows and Zone Alarm warned about it as I brought all the protection up after running ComboFix.

Log follows.

ComboFix 10-05-03.05 - Owner 05/04/2010   7:32.3.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.254.45 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\program files\WindowsUpdate
C:\zip.exe
E:\Autorun.inf

Infected copy of c:\windows\system32\DRIVERS\i8042prt.sys was found and disinfected
Restored copy from - Kitty had a snack 😛
.
(((((((((((((((((((((((((   Files Created from 2010-04-04 to 2010-05-04  )))))))))))))))))))))))))))))))
.

2010-05-04 11:21 . 2008-04-13 19:18 52480 -c--a-w- c:\windows\system32\dllcache\i8042prt.sys
2010-05-04 11:21 . 2008-04-13 19:18 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2010-05-02 00:12 . 2010-05-02 00:12 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-05-02 00:12 . 2010-05-02 00:12 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-01 04:13 . 2010-05-01 04:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-30 08:46 . 2010-04-14 16:29 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-04-30 08:46 . 2010-04-14 16:29 88480 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2010-04-30 08:46 . 2010-04-14 16:29 83496 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-04-30 08:46 . 2010-04-14 16:29 82952 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-04-30 08:46 . 2010-04-14 16:29 312616 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2010-04-30 08:46 . 2010-04-14 16:29 95568 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-04-30 08:46 . 2010-04-14 16:29 55456 ----a-w- c:\windows\system32\drivers\cfwids.sys
2010-04-27 14:09 . 2010-04-27 14:09 -------- d-----w- c:\program files\Trend Micro
2010-04-27 13:30 . 2010-04-27 13:30 -------- d-----w- c:\documents and settings\All Users\Application Data\avG

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-03 20:02 . 2009-07-28 19:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-03 02:03 . 2010-03-19 21:51 574 ----a-w- C:\cleanup.bat
2010-05-01 16:37 . 2008-11-23 13:40 -------- d-----w- c:\documents and settings\Owner\Application Data\WIPE
2010-04-30 18:22 . 2006-09-13 22:49 -------- d-----w- c:\program files\McAfee.com
2010-04-30 11:04 . 2006-09-13 22:49 -------- d-----w- c:\program files\McAfee
2010-04-30 08:46 . 2006-09-13 22:49 -------- d-----w- c:\program files\Common Files\McAfee
2010-04-29 19:39 . 2009-07-28 19:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-07-28 19:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-28 03:03 . 2010-03-17 13:00 -------- d-----w- c:\documents and settings\All Users\Application Data\com.comcast.access
2010-04-14 16:29 . 2006-09-13 22:50 51688 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-04-14 16:29 . 2006-09-13 22:49 385536 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-04-14 16:29 . 2006-09-13 22:49 152320 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-03-26 09:11 . 2006-10-10 02:34 -------- d-----w- c:\program files\Photodex Presenter
2010-03-25 18:15 . 2010-03-25 18:14 -------- d-----w- c:\program files\SONY
2010-03-25 18:15 . 2006-09-13 18:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-23 13:13 . 2008-10-28 19:45 -------- d-----w- c:\documents and settings\Owner\Application Data\U3
2010-03-19 13:46 . 2010-03-19 13:46 27671 ----a-w- C:\FileLister.vbe
2010-03-18 23:23 . 2006-09-13 18:23 96512 ----a-w- c:\windows\system32\drivers\atapi.svs
2010-03-18 23:23 . 2006-09-13 18:23 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-03-18 17:20 . 2010-03-18 17:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-17 13:02 . 2010-03-17 13:02 -------- d-----w- c:\documents and settings\Owner\Application Data\com.comcast.access.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1
2010-03-17 13:01 . 2010-03-17 13:01 -------- d-----w- c:\program files\ComcastAccess
2010-03-17 13:00 . 2010-03-17 13:00 -------- d-----w- c:\documents and settings\Owner\Application Data\Move Networks
2010-03-14 20:15 . 2006-10-29 11:48 2572 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-03-06 01:14 . 2010-03-06 00:51 -------- d-----w- c:\documents and settings\All Users\Application Data\NOS
2010-03-06 01:02 . 2006-09-14 14:50 -------- d-----w- c:\program files\Common Files\Adobe
2010-03-06 00:58 . 2010-03-06 00:58 -------- d-----w- c:\program files\Common Files\Adobe AIR
2010-03-06 00:47 . 2006-09-16 17:02 -------- d-----w- c:\documents and settings\Owner\Application Data\AdobeUM
2010-02-25 18:52 . 2010-02-25 18:52 72080 ----a-w- c:\documents and settings\Owner\g2mdlhlpx.exe
.

(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro]
@="{71B8CED8-5D67-4f57-89B1-F64CE6302A1E}"
[HKEY_CLASSES_ROOT\CLSID\{71B8CED8-5D67-4f57-89B1-F64CE6302A1E}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro2]
@="{CBAFE103-79DA-46ca-BD9A-63CBF6282882}"
[HKEY_CLASSES_ROOT\CLSID\{CBAFE103-79DA-46ca-BD9A-63CBF6282882}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro3]
@="{8B99EA55-1AFF-4539-80A0-A71C6011CD84}"
[HKEY_CLASSES_ROOT\CLSID\{8B99EA55-1AFF-4539-80A0-A71C6011CD84}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-05-16 19968]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"Zone Labs Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-24 968696]
"MaxtorOneTouch"="c:\program files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 684032]
"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-03 282624]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-01-03 185896]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-04-02 1180976]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyPro Status.lnk - c:\program files\MozyPro\mozyprostat.exe [2009-10-20 2885120]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-7-29 57344]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23721:TCP"= 23721:TCP:BitComet 23721 TCP
"23721:UDP"= 23721:UDP:BitComet 23721 UDP

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [4/30/2010 4:46 AM 82952]
R1 mozyproFilter;mozyproFilter;c:\windows\system32\drivers\mozypro.sys [4/30/2007 8:18 AM 54776]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [4/30/2010 4:46 AM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [4/30/2010 4:47 AM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [4/30/2010 4:46 AM 141792]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [4/30/2010 4:46 AM 312616]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [4/30/2010 4:46 AM 88480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [4/30/2010 4:46 AM 55456]
S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\IcdUsb2.sys [3/25/2010 2:14 PM 39048]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [4/30/2010 4:46 AM 88480]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [4/30/2010 4:46 AM 83496]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk01
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.
- - - - ORPHANS REMOVED - - - -

AddRemove-HijackThis - G:\HijackThis.exe
AddRemove-Photodex Presenter - c:\program files\Photodex Presenter\uninst.exe

 

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-04 07:53
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'explorer.exe'(2660)
c:\program files\Logitech\MouseWare\System\LgWndHk.dll
c:\program files\MozyPro\mozyproshell.dll
c:\program files\Common Files\Logitech\Scrolling\LgMsgHk.dll
.
------------------------ Other Running Processes ------------------------
.
c:\program files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
c:\program files\MozyPro\mozyprobackup.exe
c:\program files\PurgeIE\PurgeIE_Service.exe
c:\program files\Common Files\McAfee\SystemCore\mcshield.exe
c:\windows\system32\wscntfy.exe
c:\progra~1\mcafee.com\agent\mcagent.exe
c:\program files\Logitech\MouseWare\system\em_exec.exe
c:\program files\Real\RealPlayer\RealPlay.exe
.
**************************************************************************
.
Completion time: 2010-05-04  08:05:46 - machine was rebooted
ComboFix-quarantined-files.txt  2010-05-04 12:05
ComboFix2.txt  2010-03-23 16:49
ComboFix3.txt  2010-03-23 15:20

Pre-Run: 207,010,238,464 bytes free
Post-Run: 207,233,523,712 bytes free

- - End Of File - - 422EFEB32384DE569C2E9080F4C963AC

 

0 Kudos
kevin27
4 Beryllium

Re: IE Redirects

routeme2,

pev is nothing to worry about, it is a false positive, once we finish it will no longer be on your system.

Combo-Fix got the infection for us and is now clean, are you still being redirected?

The main reason that you keep getting infected is because the P2P program "bitcomet" has a open port through your firewall we are going to deal with that now.

Please post the log located at C:\Qoobox\Add-Remove Programs.txt

Thanks

K27

Malware Removal Staff at SpywareHammer

The Internet is the New Age Battle of the Old Age Clash Between Good and Evil

0 Kudos
routeme2
1 Copper

Re: IE Redirects

No redirects today, but only limited use.  Still, so far so good.  I noticed that "bitcomet" in the logs.  Poked a non-apparant hole right through ZoneAlarm.  Not so much a good thing.   

 

Log follows:

Adobe AIR
Adobe Download Manager 2.0 (Remove Only)
Adobe Flash Player 10 ActiveX
Adobe Reader 9.3.2
BCWipe 2.0
Comcast Access
Compatibility Pack for the 2007 Office system
CutePDF Writer 2.7
Dell ResourceCD
DivX Web Player
Easy CD Creator 5 Basic
FLV Player 1.3.3
GoToMeeting 4.5.0.452
HiJackThis
HijackThis 2.0.2
Hotfix for Windows XP (KB952287)
Intel(R) Extreme Graphics Driver
Java(TM) 6 Update 2
Logitech MouseWare 9.77
Malwarebytes' Anti-Malware
Maxtor Encryption
Maxtor OneTouch III
McAfee AntiVirus Plus
Microsoft .NET Framework 1.1
Microsoft Office XP Standard for Students and Teachers
Microsoft Silverlight
MotionDV STUDIO 5.3E LE for DV
Move Media Player
MozyPro Remote Backup
NetDuster Demo Version 2.3.5.0
Photodex Presenter
PurgeIE - 8.01
Quicken 2004
RealPlayer
Security Update for Windows Media Player (KB911564)
Security Update for Windows Media Player (KB952069)
Security Update for Windows Media Player 6.4 (KB925398)
Security Update for Windows Media Player 8 (KB917734)
Security Update for Windows Media Player 9 (KB917734)
Security Update for Windows XP (KB913433)
Security Update for Windows XP (KB923561)
Security Update for Windows XP (KB938464-v2)
Security Update for Windows XP (KB946648)
Security Update for Windows XP (KB950762)
Security Update for Windows XP (KB950974)
Security Update for Windows XP (KB951066)
Security Update for Windows XP (KB951376-v2)
Security Update for Windows XP (KB952004)
Security Update for Windows XP (KB952954)
Security Update for Windows XP (KB954600)
Security Update for Windows XP (KB955069)
Security Update for Windows XP (KB956572)
Security Update for Windows XP (KB956802)
Security Update for Windows XP (KB957097)
Security Update for Windows XP (KB958644)
Security Update for Windows XP (KB958687)
Security Update for Windows XP (KB959426)
Security Update for Windows XP (KB960225)
Security Update for Windows XP (KB960803)
Security Update for Windows XP (KB961371)
Security Update for Windows XP (KB961501)
Security Update for Windows XP (KB968537)
Security Update for Windows XP (KB970238)
Security Update for Windows XP (KB971633)
Security Update for Windows XP (KB972260)
Security Update for Windows XP (KB973346)
Sony Digital Voice Editor 2
SoundMAX
Spybot - Search & Destroy 1.4
Stomp Backup MyPC
Stomp Backup MyPC Update Manager
Update for Windows XP (KB955839)
Update for Windows XP (KB967715)
WebEx
WebFldrs XP
Windows Genuine Advantage Notifications (KB905474)
Windows Genuine Advantage Validation Tool (KB892130)
Windows XP Service Pack 3
WinRAR archiver
WinZip
Wipe
ZoneAlarm

0 Kudos
kevin27
4 Beryllium

Re: IE Redirects

Hi,

Please open ZoneAlarm and click "Program Control", then please click "Programs", you should then see a list of all the programs that are allowed access through ZoneAlarm, please find "BitComet" and then click each green tick next to "BitComet" and change it to "Block", the ticks should now become red crosses (X)

Once you have blocked BitComets access through the firewall, please reboot your machine and post a fresh Combo-Fix log.

Thanks

K27

Malware Removal Staff at SpywareHammer

The Internet is the New Age Battle of the Old Age Clash Between Good and Evil

0 Kudos
routeme2
1 Copper

Re: IE Redirects

"BitComet" does not appear in ZoneAlarm's Program Control list.  I ran Combo-Fix and the log follows.  The machine still seems to be running without issues so far.  Should be able to give it a better workout today. 

As an aside, the TDL3 pdf made for a fascinating read.   Thank you for the link.

******************************************

ComboFix 10-05-04.05 - Owner 05/05/2010   6:27.4.1 - x86
Microsoft Windows XP Home Edition  5.1.2600.3.1252.1.1033.18.254.106 [GMT -4:00]
Running from: c:\documents and settings\Owner\Desktop\ComboFix.exe
AV: McAfee VirusScan *On-access scanning disabled* (Updated) {84B5EE75-6421-4CDE-A33A-DD43BA9FAD83}
FW: ZoneAlarm Firewall *disabled* {829BDA32-94B3-44F4-8446-F8FCFF809F8B}
.

(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.

E:\Autorun.inf

.
(((((((((((((((((((((((((   Files Created from 2010-04-05 to 2010-05-05  )))))))))))))))))))))))))))))))
.

2010-05-04 11:21 . 2008-04-13 19:18 52480 -c--a-w- c:\windows\system32\dllcache\i8042prt.sys
2010-05-04 11:21 . 2008-04-13 19:18 52480 ----a-w- c:\windows\system32\drivers\i8042prt.sys
2010-05-02 00:12 . 2010-05-02 00:12 552 ----a-w- c:\windows\system32\d3d8caps.dat
2010-05-02 00:12 . 2010-05-02 00:12 664 ----a-w- c:\windows\system32\d3d9caps.dat
2010-05-01 04:13 . 2010-05-01 04:15 -------- d-----w- c:\documents and settings\NetworkService\Local Settings\Application Data\Adobe
2010-04-30 08:46 . 2010-04-14 16:29 9344 ----a-w- c:\windows\system32\drivers\mfeclnk.sys
2010-04-30 08:46 . 2010-04-14 16:29 88480 ----a-w- c:\windows\system32\drivers\mfendisk.sys
2010-04-30 08:46 . 2010-04-14 16:29 83496 ----a-w- c:\windows\system32\drivers\mferkdet.sys
2010-04-30 08:46 . 2010-04-14 16:29 82952 ----a-w- c:\windows\system32\drivers\mfetdi2k.sys
2010-04-30 08:46 . 2010-04-14 16:29 312616 ----a-w- c:\windows\system32\drivers\mfefirek.sys
2010-04-30 08:46 . 2010-04-14 16:29 95568 ----a-w- c:\windows\system32\drivers\mfeapfk.sys
2010-04-30 08:46 . 2010-04-14 16:29 55456 ----a-w- c:\windows\system32\drivers\cfwids.sys
2010-04-27 14:09 . 2010-04-27 14:09 -------- d-----w- c:\program files\Trend Micro
2010-04-27 13:30 . 2010-04-27 13:30 -------- d-----w- c:\documents and settings\All Users\Application Data\avG

.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-05-03 20:02 . 2009-07-28 19:22 -------- d-----w- c:\program files\Malwarebytes' Anti-Malware
2010-05-03 02:03 . 2010-03-19 21:51 574 ----a-w- C:\cleanup.bat
2010-05-01 16:37 . 2008-11-23 13:40 -------- d-----w- c:\documents and settings\Owner\Application Data\WIPE
2010-04-30 18:22 . 2006-09-13 22:49 -------- d-----w- c:\program files\McAfee.com
2010-04-30 11:04 . 2006-09-13 22:49 -------- d-----w- c:\program files\McAfee
2010-04-30 08:46 . 2006-09-13 22:49 -------- d-----w- c:\program files\Common Files\McAfee
2010-04-29 19:39 . 2009-07-28 19:23 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-04-29 19:39 . 2009-07-28 19:22 20952 ----a-w- c:\windows\system32\drivers\mbam.sys
2010-04-29 13:56 . 2010-04-29 13:56 109056 ----a-w- c:\windows\Internet Logs\xDB11.tmp
2010-04-28 03:03 . 2010-03-17 13:00 -------- d-----w- c:\documents and settings\All Users\Application Data\com.comcast.access
2010-04-27 17:27 . 2010-04-27 17:45 136192 ----a-w- c:\windows\Internet Logs\xDB10.tmp
2010-04-27 14:09 . 2010-04-27 14:09 388096 ----a-r- c:\documents and settings\Owner\Application Data\Microsoft\Installer\{45A66726-69BC-466B-A7A4-12FCBA4883D7}\HiJackThis.exe
2010-04-26 21:55 . 2010-04-26 21:55 5918776 ----a-w- c:\documents and settings\All Users\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\mbam-setup.exe
2010-04-26 14:59 . 2010-04-26 15:05 1616384 ----a-w- c:\windows\Internet Logs\xDBF.tmp
2010-04-14 16:29 . 2006-09-13 22:50 51688 ----a-w- c:\windows\system32\drivers\mfebopk.sys
2010-04-14 16:29 . 2006-09-13 22:49 385536 ----a-w- c:\windows\system32\drivers\mfehidk.sys
2010-04-14 16:29 . 2006-09-13 22:49 152320 ----a-w- c:\windows\system32\drivers\mfeavfk.sys
2010-03-26 09:11 . 2006-10-10 02:34 -------- d-----w- c:\program files\Photodex Presenter
2010-03-25 18:15 . 2010-03-25 18:14 -------- d-----w- c:\program files\SONY
2010-03-25 18:15 . 2006-09-13 18:18 -------- d--h--w- c:\program files\InstallShield Installation Information
2010-03-23 15:31 . 2006-12-06 13:47 29745003 ----a-w- c:\windows\Internet Logs\tvDebug.zip
2010-03-23 13:13 . 2008-10-28 19:45 -------- d-----w- c:\documents and settings\Owner\Application Data\U3
2010-03-19 13:46 . 2010-03-19 13:46 27671 ----a-w- C:\FileLister.vbe
2010-03-19 12:07 . 2010-03-19 12:55 923648 ----a-w- c:\windows\Internet Logs\xDBE.tmp
2010-03-18 23:23 . 2006-09-13 18:23 96512 ----a-w- c:\windows\system32\drivers\atapi.svs
2010-03-18 23:23 . 2006-09-13 18:23 96512 ------w- c:\windows\system32\drivers\atapi.sys
2010-03-18 17:20 . 2010-03-18 17:20 -------- d-----w- c:\documents and settings\Administrator\Application Data\Malwarebytes
2010-03-18 14:33 . 2010-03-18 14:33 2754560 ----a-w- c:\windows\Internet Logs\xDBD.tmp
2010-03-17 13:02 . 2010-03-17 13:02 -------- d-----w- c:\documents and settings\Owner\Application Data\com.comcast.access.13A1FA90F0FC9DC009FB0956ADD0F13F8608561B.1
2010-03-17 13:01 . 2010-03-17 13:01 -------- d-----w- c:\program files\ComcastAccess
2010-03-17 13:00 . 2010-03-17 13:00 144162 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\uninstall.exe
2010-03-17 13:00 . 2010-03-17 13:00 -------- d-----w- c:\documents and settings\Owner\Application Data\Move Networks
2010-03-17 13:00 . 2009-12-18 03:27 5603776 ----a-w- c:\documents and settings\Owner\Application Data\Move Networks\plugins\npqmp071706000001.dll
2010-03-14 20:15 . 2006-10-29 11:48 2572 ----a-w- c:\windows\system32\PerfStringBackup.TMP
2010-03-06 00:55 . 2010-03-17 13:17 38784 ----a-w- c:\documents and settings\Owner\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-06 00:55 . 2010-03-06 00:58 38784 ----a-w- c:\documents and settings\Default User\Application Data\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
2010-03-06 00:52 . 2010-03-06 00:52 86016 ----a-w- c:\documents and settings\All Users\Application Data\NOS\Adobe_Downloads\arh.exe
2010-03-06 00:47 . 2010-03-06 00:47 55432 ----a-w- c:\documents and settings\Owner\Application Data\Adobe\Acrobat\7.0\Updater\DLMUninst_001.exe
2010-03-05 02:03 . 2006-09-13 18:12 77423 ----a-w- c:\windows\PCHealth\HelpCtr\OfflineCache\index.dat
2010-02-25 18:52 . 2010-02-25 18:52 72080 ----a-w- c:\documents and settings\Owner\g2mdlhlpx.exe
.

(((((((((((((((((((((((((((((   SnapShot@2010-03-23_15.16.45   )))))))))))))))))))))))))))))))))))))))))
.
+ 2010-05-04 11:49 . 2010-05-04 11:49 16384              c:\windows\Temp\Perflib_Perfdata_1d4.dat
+ 2010-03-25 18:14 . 2001-08-31 20:14 57344              c:\windows\system32\StrmOut.dll
+ 2010-03-25 18:14 . 2005-07-04 12:56 86016              c:\windows\system32\spicc.dll
+ 2010-03-25 18:14 . 2002-03-01 20:25 69632              c:\windows\system32\spc.dll
+ 2010-03-25 18:14 . 2001-12-13 17:44 65536              c:\windows\system32\rcnv2.dll
+ 2010-03-25 18:14 . 2006-02-01 23:05 94208              c:\windows\system32\IcdYsys.dll
+ 2010-03-25 18:14 . 2003-06-26 15:49 61440              c:\windows\system32\ICDUSB2.dll
+ 2010-03-25 18:14 . 2000-11-14 20:00 49664              c:\windows\system32\ICDUSB.dll
+ 2010-03-25 18:14 . 2003-04-02 02:08 24576              c:\windows\system32\IcdSptSvps.dll
+ 2010-03-25 18:14 . 2003-04-02 02:08 69632              c:\windows\system32\IcdSptSv.exe
+ 2010-03-25 18:14 . 2006-02-03 19:19 57344              c:\windows\system32\IcdSpi.dll
+ 2010-03-25 18:14 . 2002-04-04 23:52 28672              c:\windows\system32\IcdShare.dll
+ 2010-03-25 18:14 . 2005-10-20 13:10 61440              c:\windows\system32\IcdSConv.dll
+ 2010-03-25 18:14 . 2005-07-04 15:11 77824              c:\windows\system32\IcdMSCom.dll
+ 2010-03-25 18:14 . 2001-04-26 01:44 28160              c:\windows\system32\icdcomm.dll
+ 2010-03-25 18:14 . 2006-01-17 21:25 86016              c:\windows\system32\IcdCdda.dll
+ 2010-03-25 18:14 . 2001-03-07 19:23 81920              c:\windows\system32\dsp_trc.dll
+ 2010-03-25 18:14 . 2001-11-05 23:05 61440              c:\windows\system32\DSConv.dll
+ 2010-03-25 18:14 . 2002-11-29 01:23 39048              c:\windows\system32\drivers\IcdUsb2.sys
+ 2010-03-25 18:14 . 2001-10-31 17:20 26409              c:\windows\system32\drivers\Icdusb.sys
+ 2010-03-25 18:15 . 2003-10-01 21:44 31744              c:\windows\system32\drivers\IcdSX.sys
+ 2006-09-13 18:15 . 2010-05-05 06:01 32768              c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-13 18:15 . 2010-03-23 14:47 32768              c:\windows\system32\config\systemprofile\Local Settings\History\History.IE5\index.dat
- 2006-09-13 18:15 . 2010-03-23 14:47 32768              c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-05-04 16:09 . 2010-05-05 06:01 32768              c:\windows\system32\config\systemprofile\Cookies\index.dat
+ 2010-03-25 18:15 . 2001-09-13 06:15 90112              c:\windows\snymsico.dll
+ 2009-12-22 01:09 . 2009-12-22 01:09 16832              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\ViewerPS.dll
+ 2009-12-22 06:57 . 2009-12-22 06:57 35760              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\reader_sl.exe
+ 2009-12-22 01:02 . 2009-12-22 01:02 79280              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\PDFPrevHndlr.dll
+ 2009-12-22 04:21 . 2009-12-22 04:21 99776              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\eula.exe
+ 2009-12-22 04:37 . 2009-12-22 04:37 27048              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\acrotextextractor.exe
+ 2009-12-21 23:39 . 2009-12-21 23:39 15288              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroRd32Info.exe
+ 2009-12-21 23:27 . 2009-12-21 23:27 75200              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\acroiehelpershim.dll
+ 2009-12-21 23:27 . 2009-12-21 23:27 61888              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroIEHelper.dll
+ 2009-01-05 19:44 . 2009-01-05 19:44 53248              c:\windows\bdoscandel.exe
+ 2010-03-24 13:58 . 2010-03-24 13:58 86016              c:\windows\BDOSCAN8\librtvr.dll
+ 2010-03-24 13:58 . 2010-03-24 13:58 27136              c:\windows\BDOSCAN8\avxt.dll
+ 2010-03-24 13:58 . 2010-03-24 13:58 10240              c:\windows\BDOSCAN8\avxs.dll
+ 2010-03-24 13:58 . 2010-03-24 13:58 45056              c:\windows\BDOSCAN8\avxdisk.dll
+ 2010-03-25 18:14 . 2002-06-24 18:50 122880              c:\windows\system32\trc.dll
+ 2010-03-25 18:14 . 2001-11-30 16:15 323584              c:\windows\system32\LPEC.dll
+ 2010-03-25 18:14 . 2001-01-10 11:47 317440              c:\windows\system32\IcdXa.dll
+ 2010-03-25 18:14 . 2002-08-26 18:22 209408              c:\windows\system32\IcdStor2.dll
+ 2010-03-25 18:14 . 2006-01-23 20:57 176128              c:\windows\system32\IcdShlex.dll
+ 2010-03-25 18:14 . 2003-02-05 14:36 208896              c:\windows\system32\ICDFConv.dll
+ 2010-03-25 18:14 . 2005-10-03 16:52 118784              c:\windows\system32\icdcomm3.dll
+ 2010-03-25 18:14 . 2004-08-28 17:08 122880              c:\windows\system32\icdcomm2.dll
+ 2009-12-21 23:35 . 2009-12-21 23:35 378264              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\pdfshell.dll
+ 2009-12-22 01:05 . 2009-12-22 01:05 116168              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\PDFPrevHndlrShim.exe
+ 2009-12-21 23:34 . 2009-12-21 23:34 103864              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\nppdf32.dll
+ 2009-11-10 00:18 . 2009-11-10 00:18 684032              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\JP2KLib.dll
+ 2009-12-22 01:02 . 2009-12-22 01:02 542168              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AdobeCollabSync.exe
+ 2009-12-21 23:43 . 2009-12-21 23:43 120240              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroRdIF.dll
+ 2009-12-22 06:57 . 2009-12-22 06:57 349616              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroRd32.exe
+ 2009-12-21 23:15 . 2009-12-21 23:15 660912              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroPDF.dll
+ 2009-12-22 00:32 . 2009-12-22 00:32 280024              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\acrobroker.exe
+ 2009-12-22 00:15 . 2009-12-22 00:15 251296              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\a3dutility.exe
+ 2009-01-05 19:44 . 2009-01-05 19:44 741376              c:\windows\Downloaded Program Files\ipsupd.dll
+ 2009-01-05 19:44 . 2010-03-24 13:58 142848              c:\windows\BDOSCAN8\libfn.dll
+ 2009-01-05 19:44 . 2009-01-05 19:44 741376              c:\windows\BDOSCAN8\ipsupd.dll
+ 2009-01-05 19:44 . 2010-03-24 14:04 107800              c:\windows\BDOSCAN8\bdcore.dll
+ 2010-04-27 13:53 . 2010-04-27 13:53 1094656              c:\windows\Installer\2e728ab.msi
+ 2009-12-21 23:29 . 2009-12-21 23:29 2409880              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\rt3d.dll
+ 2009-12-22 04:31 . 2009-12-22 04:31 5713920              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AGM.dll
+ 2010-04-04 06:54 . 2010-04-04 06:54 11850240              c:\windows\Installer\49da9.msp
+ 2009-12-22 04:21 . 2009-12-22 04:21 20436408              c:\windows\Installer\$PatchCache$\Managed\68AB67CA7DA73301B7449A0300000010\9.3.0\AcroRd32.dll
.
-- Snapshot reset to current date --
.
(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro]
@="{71B8CED8-5D67-4f57-89B1-F64CE6302A1E}"
[HKEY_CLASSES_ROOT\CLSID\{71B8CED8-5D67-4f57-89B1-F64CE6302A1E}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro2]
@="{CBAFE103-79DA-46ca-BD9A-63CBF6282882}"
[HKEY_CLASSES_ROOT\CLSID\{CBAFE103-79DA-46ca-BD9A-63CBF6282882}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\mozypro3]
@="{8B99EA55-1AFF-4539-80A0-A71C6011CD84}"
[HKEY_CLASSES_ROOT\CLSID\{8B99EA55-1AFF-4539-80A0-A71C6011CD84}]
2009-10-20 20:04 2840576 ----a-w- c:\program files\MozyPro\mozyproshell.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logitech Utility"="Logi_MwX.Exe" [2003-05-16 19968]
"IgfxTray"="c:\windows\System32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows\System32\hkcmd.exe" [2003-04-07 114688]
"Zone Labs Client"="c:\program files\Zone Labs\ZoneAlarm\zlclient.exe" [2006-08-24 968696]
"MaxtorOneTouch"="c:\program files\Maxtor\OneTouch\utils\Onetouch.exe" [2006-03-01 712704]
"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-12-17 684032]
"StorageGuard"="c:\program files\VERITAS Software\Update Manager\sgtray.exe" [2002-06-18 155648]
"QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2006-11-03 282624]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-01-03 185896]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"mcui_exe"="c:\program files\McAfee.com\Agent\mcagent.exe" [2010-04-02 1180976]

c:\documents and settings\All Users\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
MozyPro Status.lnk - c:\program files\MozyPro\mozyprostat.exe [2009-10-20 2885120]
Quicken Scheduled Updates.lnk - c:\program files\Quicken\bagent.exe [2003-7-29 57344]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\mcmscsvc]
@=""

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\MCODS]
@=""

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
"FirewallOverride"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiVirus]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
"DisableNotifications"= 1 (0x1)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23721:TCP"= 23721:TCP:BitComet 23721 TCP
"23721:UDP"= 23721:UDP:BitComet 23721 UDP

R1 mfetdi2k;McAfee Inc. mfetdi2k;c:\windows\system32\drivers\mfetdi2k.sys [4/30/2010 4:46 AM 82952]
R1 mozyproFilter;mozyproFilter;c:\windows\system32\drivers\mozypro.sys [4/30/2007 8:18 AM 54776]
R2 McNaiAnn;McAfee VirusScan Announcer;"c:\program files\Common Files\McAfee\McSvcHost\McSvHost.exe" /McCoreSvc [4/30/2010 4:46 AM 271480]
R2 mfefire;McAfee Firewall Core Service;c:\program files\Common Files\McAfee\SystemCore\mfefire.exe [4/30/2010 4:47 AM 188136]
R2 mfevtp;McAfee Validation Trust Protection Service;c:\program files\Common Files\McAfee\SystemCore\mfevtps.exe [4/30/2010 4:46 AM 141792]
R3 mfefirek;McAfee Inc. mfefirek;c:\windows\system32\drivers\mfefirek.sys [4/30/2010 4:46 AM 312616]
R3 mfendiskmp;mfendiskmp;c:\windows\system32\drivers\mfendisk.sys [4/30/2010 4:46 AM 88480]
S3 cfwids;McAfee Inc. cfwids;c:\windows\system32\drivers\cfwids.sys [4/30/2010 4:46 AM 55456]
S3 ICDUSB2;Sony IC Recorder (P);c:\windows\system32\drivers\IcdUsb2.sys [3/25/2010 2:14 PM 39048]
S3 mfendisk;McAfee Core NDIS Intermediate Filter;c:\windows\system32\drivers\mfendisk.sys [4/30/2010 4:46 AM 88480]
S3 mferkdet;McAfee Inc. mferkdet;c:\windows\system32\drivers\mferkdet.sys [4/30/2010 4:46 AM 83496]

--- Other Services/Drivers In Memory ---

*Deregistered* - mfeavfk01
.
.
------- Supplementary Scan -------
.
IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
DPF: DirectAnimation Java Classes - file://c:\windows\Java\classes\dajava.cab
DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
.

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-05-05 06:38
Windows 5.1.2600 Service Pack 3 NTFS

scanning hidden processes ... 

scanning hidden autostart entries ...

scanning hidden files ... 

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2010-05-05  06:45:33
ComboFix-quarantined-files.txt  2010-05-05 10:45
ComboFix2.txt  2010-05-04 12:05
ComboFix3.txt  2010-03-23 16:49
ComboFix4.txt  2010-03-23 15:20

Pre-Run: 206,988,148,736 bytes free
Post-Run: 206,979,784,704 bytes free

- - End Of File - - 8259D79091BAC7EBC5A0B5015F62234B

 

 

0 Kudos
kevin27
4 Beryllium

Re: IE Redirects

routeme2,

 

PLEASE BE SURE TO DISABLE ALL PROTECTIVE SOFTWARE THAT IS RUNNING ON YOUR MACHINE BEFORE RUNNING COMBO-FIX, SO THAT COMBO-FIX IS NOT HINDERED IN ITS REMOVAL PROCESS

Please:

  • Disable all Anti-virus/Anti-Spyware/FireWall on your machine(instructions via links below)Anti Virus
    Anti Spyware
  • If you have trouble disabling your firewall please post back before continuning which one you use and I will give you the instructioins. (If its a third party Firewall there should be a Icon on your task bar by the clock, right click that and choose Disable/Stop. If its the Windows built-in firewall you should be able to disable it via Control Panel.



Next we are going to run Combo-Fix in a slightly different way

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

3. Open notepad and copy/paste the text in the quote box below into it:

Quote:

Folder::
c:\documents and settings\All Users\Application Data\avG

Registry::
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"23721:TCP"=-
"23721:UDP"=-





Save this as CFScript.txt, in the same location as ComboFix.exe





Refering to the picture above, drag CFScript into ComboFix.exe

When finished, it shall produce a log for you at C:\ComboFix.txt which I will require in your next reply.

Thanks
K27.

Malware Removal Staff at SpywareHammer

The Internet is the New Age Battle of the Old Age Clash Between Good and Evil

0 Kudos