x-kom hosting

Wolno działający komputer, znikający pulpit.

alonso
utworzono
utworzono (edytowane)

Od pewnego czasu mam problem z komputerem. Czasami uruchamia się szybko ale bardzo często trwa to dość długo . Zdarza się, że giną wszystkie ikony na pulpicie - widoczna jest tylko tapeta. Ostatnio również pulpit jakby był zablokowany tzn. nie istnieje możliwość kliknięcia na ikonkę.

[log]

OTL logfile created on: 2013-09-02 20:58:43 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Komputer\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,23 Mb Total Physical Memory | 91,19 Mb Available Physical Memory | 17,84% Memory free
1,22 Gb Paging File | 0,45 Gb Available in Paging File | 36,80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30,27 Gb Total Space | 12,09 Gb Free Space | 39,94% Space Free | Partition Type: NTFS
Drive D: | 40,75 Gb Total Space | 7,14 Gb Free Space | 17,53% Space Free | Partition Type: NTFS
Drive E: | 40,76 Gb Total Space | 3,66 Gb Free Space | 8,99% Space Free | Partition Type: NTFS

Computer Name: NOWAK | User Name: Komputer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Processes (SafeList) ==========

PRC - [2013-09-02 20:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe
PRC - [2013-08-08 19:33:48 | 001,303,360 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe
PRC - [2013-08-08 19:33:48 | 000,807,800 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe
PRC - [2013-07-04 20:10:43 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe
PRC - [2013-06-18 17:15:51 | 004,785,848 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
PRC - [2013-06-18 17:15:26 | 009,036,504 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cis.exe
PRC - [2013-06-18 17:15:26 | 001,839,832 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
PRC - [2013-06-18 17:15:26 | 001,460,952 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cistray.exe
PRC - [2013-01-19 17:21:49 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe
PRC - [2012-07-19 16:07:51 | 000,821,840 | ---- | M] (ABBYY) -- C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe
PRC - [2008-04-14 23:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2004-09-29 13:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe


========== Modules (No Company Name) ==========

MOD - [2013-08-21 16:53:42 | 016,166,280 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll
MOD - [2013-07-04 20:11:05 | 000,835,584 | ---- | M] () -- C:\Program Files\Opera\gstreamer\gstreamer.dll
MOD - [2013-07-04 20:11:05 | 000,312,832 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll
MOD - [2013-07-04 20:11:05 | 000,158,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll
MOD - [2013-07-04 20:11:05 | 000,101,888 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll
MOD - [2013-07-04 20:11:05 | 000,096,256 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll
MOD - [2013-07-04 20:11:05 | 000,094,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll
MOD - [2013-07-04 20:11:05 | 000,093,696 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll
MOD - [2013-07-04 20:11:05 | 000,073,728 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll
MOD - [2013-07-04 20:11:05 | 000,067,072 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll
MOD - [2013-07-04 20:11:05 | 000,062,976 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll
MOD - [2013-07-04 20:11:05 | 000,057,344 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll
MOD - [2013-07-04 20:11:05 | 000,038,912 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll
MOD - [2013-06-18 17:15:33 | 002,463,448 | ---- | M] () -- C:\Program Files\COMODO\COMODO Internet Security\cmdavcen.dll
MOD - [2009-01-09 18:10:52 | 000,139,264 | ---- | M] () -- C:\Program Files\Brother\BrUtilities\BrLogAPI.dll
MOD - [2008-04-14 23:50:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll


========== Services (SafeList) ==========

SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2013-08-21 16:53:46 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013-08-08 19:33:48 | 000,807,800 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater)
SRV - [2013-06-18 17:15:51 | 004,785,848 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent)
SRV - [2013-06-18 17:15:27 | 000,127,192 | ---- | M] (COMODO) [On_Demand | Stopped] -- C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe -- (cmdvirth)
SRV - [2013-06-02 22:52:50 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013-01-19 17:21:49 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService)
SRV - [2013-01-03 13:43:58 | 001,259,448 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012-07-19 16:07:51 | 000,821,840 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Corporate.11.0)
SRV - [2004-09-29 13:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)


========== Driver Services (SafeList) ==========

DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP)
DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump)
DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc)
DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt)
DRV - File not found [Kernel | System | Stopped] -- -- (Changer)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\Drivers\AsrCDDrv.sys -- (AsrCDDrv)
DRV - [2013-06-18 17:16:22 | 000,099,520 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\inspect.sys -- (Inspect)
DRV - [2013-06-18 17:16:22 | 000,032,816 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp)
DRV - [2013-06-18 17:16:21 | 000,593,408 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard)
DRV - [2013-06-18 17:16:20 | 000,018,528 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmderd.sys -- (cmderd)
DRV - [2013-01-17 13:37:19 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV - [2009-11-24 09:04:26 | 001,617,408 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2009-06-26 09:29:34 | 001,656,960 | R--- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (AMBFilt)
DRV - [2008-12-02 08:56:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (MonFilt)
DRV - [2008-10-30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp)
DRV - [2006-08-08 10:54:30 | 000,182,528 | R--- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiHFF04.sys -- (SaiHFF04)
DRV - [2006-08-08 10:54:30 | 000,016,512 | R--- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiIFF04.sys -- (SaiIFF04)
DRV - [2006-07-02 00:32:26 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8)
DRV - [2001-08-17 23:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)


========== Standard Registry (SafeList) ==========


========== Internet Explorer ==========

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/?utm_source=is
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL


IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0



IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/?utm_source=is
IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\URLSearchHook: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.)
IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes,DefaultScope = {BB74DE59-BC4C-4172-9AC4-73315F71CFFE}
IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL
IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

========== FireFox ==========

FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=902615"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..browser.startup.homepage: "http://www.interia.pl/?utm_source=is"
FF - prefs.js..extensions.enabledAddons: IplextoALL%40ALLPlayer.org:0.7.0
FF - prefs.js..extensions.enabledAddons: YoutubeDownloader%40PeterOlayev.com:2.0.6
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2
FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=902615&p="
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
FF - user.js - File not found

FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.)
FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)

FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013-06-02 22:53:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins

[2013-02-16 14:30:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Extensions
[2013-08-31 19:49:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions
[2013-03-26 12:01:11 | 000,010,043 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\IplextoALL@ALLPlayer.org.xpi
[2013-08-31 19:49:23 | 000,032,675 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\YoutubeDownloader@PeterOlayev.com.xpi
[2013-03-26 11:59:01 | 000,221,336 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi
[2013-08-09 20:26:32 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\searchplugins\yahoo.xml
[2013-06-02 22:51:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2013-06-02 22:52:59 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013-06-02 22:52:22 | 000,002,980 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml
[2013-06-02 22:52:22 | 000,001,619 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml
[2013-06-02 22:52:21 | 000,001,130 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml
[2013-06-02 22:52:21 | 000,001,071 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml
[2013-06-02 22:52:21 | 000,001,396 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml
[2013-06-02 22:52:20 | 000,001,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml

========== Chrome ==========

CHR - homepage: http://www.interia.pl/?utm_source=is

O1 HOSTS File: ([2001-10-26 17:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2 - BHO: (IObit Apps Toolbar) - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (ALLYouTubeDownloader) - {61DB16C5-B733-43F4-872E-B20DC9E72740} - C:\Program Files\ALLYouTubeDownloader\ALLYouTubeDownloader.dll (ALLCinema Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.)
O3 - HKLM\..\Toolbar: (IObit Apps Toolbar) - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.)
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe (COMODO)
O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003..\Run: [ASRSetup] F:\ASRSetup.exe File not found
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Pobierz plik wideo w FDM - C:\Program Files\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Pobierz w FDM - C:\Program Files\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: Pobierz wszystkie pliki w FDM - C:\Program Files\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Pobierz zaznaczone pliki w FDM - C:\Program Files\Free Download Manager\dlselected.htm ()
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8B63319-8AE4-4BE8-841A-0E1C04AB69E9}: DhcpNameServer = 192.168.1.1 192.168.1.1
O20 - AppInit_DLLs: (c:\progra~1\browse~1\sprote~1.dll) - File not found
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home
O24 - Desktop WallPaper: E:\bez tytułu.bmp
O24 - Desktop BackupWallPaper: E:\bez tytułu.bmp
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2013-01-17 13:02:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2010-06-07 22:31:46 | 000,000,000 | ---D | M] - D:\autorun.inf -- [ NTFS ]
O32 - AutoRun File - [2010-06-07 22:31:46 | 000,000,000 | ---D | M] - E:\autorun.inf -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

========== Files/Folders - Created Within 30 Days ==========

[2013-09-02 21:02:06 | 000,663,128 | ---- | C] (Duplex Secure Ltd.) -- C:\Documents and Settings\Komputer\Pulpit\SPTDinst-v183-x86.exe
[2013-09-02 20:55:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe
[2013-08-25 12:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MachineheadSoftware
[2013-08-25 12:02:08 | 000,000,000 | ---D | C] -- C:\Program Files\mhead32
[2013-08-25 12:01:44 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\Setup1.exe
[2013-08-25 12:01:36 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE
[2013-08-25 12:01:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14
[2013-08-25 11:40:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Komputer\Recent
[2013-08-20 20:03:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Pulpit\WOP_Katalog2013_PL
[2013-08-09 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings
[2013-08-09 20:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2013-08-09 20:26:24 | 000,000,000 | ---D | C] -- C:\Program Files\IObit Apps Toolbar
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Komputer\Pulpit\*.tmp files -> C:\Documents and Settings\Komputer\Pulpit\*.tmp -> ]

========== Files - Modified Within 30 Days ==========

[2013-09-02 21:29:15 | 000,001,040 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
[2013-09-02 21:02:10 | 000,663,128 | ---- | M] (Duplex Secure Ltd.) -- C:\Documents and Settings\Komputer\Pulpit\SPTDinst-v183-x86.exe
[2013-09-02 20:56:10 | 000,368,554 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\gmer.zip
[2013-09-02 20:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe
[2013-09-02 20:52:04 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job
[2013-09-02 19:29:17 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
[2013-09-02 18:42:41 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job
[2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job
[2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job
[2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job
[2013-09-02 17:41:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013-09-01 15:10:56 | 000,002,034 | ---- | M] () -- C:\WINDOWS\System32\SaiCFF04-7F4FF365-1416-479D-B166-5FED9B8417E5.pr0
[2013-08-28 20:42:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013-08-27 15:46:25 | 000,436,322 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat
[2013-08-27 15:46:25 | 000,380,486 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013-08-27 15:46:25 | 000,067,298 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat
[2013-08-27 15:46:25 | 000,052,900 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013-08-25 12:01:44 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Setup1.exe
[2013-08-25 12:01:36 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE
[2013-08-25 12:00:56 | 001,597,036 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14.zip
[2013-08-21 16:53:43 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe
[2013-08-21 16:53:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl
[2013-08-19 21:00:34 | 000,015,436 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\RAP.m3u
[2013-08-19 19:03:23 | 000,100,783 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\arturkrolbrytow.jpg
[2013-08-17 21:04:21 | 055,740,683 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\Bob_Air_-_instrumentale_Vol.2.zip
[2013-08-11 17:00:38 | 000,001,805 | ---- | M] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\recently-used.xbel
[2013-08-06 11:27:14 | 000,162,063 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\oswiadczenie.pdf
[2013-08-06 11:26:08 | 000,163,206 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\podanie.pdf
[2013-08-05 21:16:21 | 000,060,224 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\f5d189885a48d71e25f50fab86ab8d0a.jpg
[1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
[1 C:\Documents and Settings\Komputer\Pulpit\*.tmp files -> C:\Documents and Settings\Komputer\Pulpit\*.tmp -> ]

========== Files Created - No Company Name ==========

[2013-09-02 20:56:10 | 000,368,554 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\gmer.zip
[2013-08-25 12:00:54 | 001,597,036 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14.zip
[2013-08-19 21:00:34 | 000,015,436 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\RAP.m3u
[2013-08-19 19:03:23 | 000,100,783 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\arturkrolbrytow.jpg
[2013-08-17 20:48:59 | 055,740,683 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\Bob_Air_-_instrumentale_Vol.2.zip
[2013-08-11 17:00:38 | 000,001,805 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\recently-used.xbel
[2013-08-10 13:48:51 | 000,002,034 | ---- | C] () -- C:\WINDOWS\System32\SaiCFF04-7F4FF365-1416-479D-B166-5FED9B8417E5.pr0
[2013-08-06 13:17:26 | 000,191,885 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\dowod 001.jpg
[2013-08-06 13:17:26 | 000,175,389 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\dowod2 001.jpg
[2013-08-06 13:17:15 | 000,162,063 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\oswiadczenie.pdf
[2013-08-06 13:17:08 | 000,163,206 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\podanie.pdf
[2013-08-05 21:16:20 | 000,060,224 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\f5d189885a48d71e25f50fab86ab8d0a.jpg
[2013-06-20 13:13:02 | 000,003,260 | ---- | C] () -- C:\WINDOWS\System32\drivers\fvstore.dat
[2013-03-13 19:09:41 | 000,178,688 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll
[2013-02-15 13:35:13 | 001,474,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfi.dat
[2013-02-08 15:34:22 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf08b.dat
[2013-02-08 15:34:19 | 000,000,404 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI
[2013-02-08 15:31:39 | 000,031,767 | ---- | C] () -- C:\WINDOWS\maxlink.ini
[2013-01-20 14:13:41 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013-01-17 17:42:09 | 000,644,608 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll
[2013-01-17 17:42:09 | 000,258,048 | ---- | C] () -- C:\WINDOWS\System32\libFLAC.dll
[2013-01-17 15:50:57 | 000,207,360 | ---- | C] () -- C:\WINDOWS\System32\evrprop.dll
[2013-01-17 15:50:02 | 000,080,384 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll
[2013-01-17 15:50:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll
[2013-01-17 15:47:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2013-01-17 15:17:14 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\fusioncache.dat
[2013-01-17 15:15:16 | 001,998,848 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04.Dll
[2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_10.dll
[2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0C.dll
[2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0A.dll
[2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_07.dll
[2013-01-17 15:15:16 | 000,006,656 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_09.dll
[2013-01-17 15:15:16 | 000,006,656 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0402.dll
[2013-01-17 13:52:51 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI
[2013-01-17 13:51:27 | 000,217,656 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT
[2013-01-17 13:19:27 | 000,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe
[2013-01-17 13:15:13 | 001,073,008 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin
[2013-01-17 13:15:13 | 001,073,008 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin
[2013-01-17 13:15:13 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin
[2013-01-17 13:14:50 | 002,816,600 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data
[2013-01-17 13:05:38 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat
[2013-01-17 12:58:59 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat

========== ZeroAccess Check ==========

[2013-01-17 15:07:35 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008-04-14 23:50:48 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2008-04-14 23:50:32 | 000,472,064 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-14 23:50:58 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

========== LOP Check ==========

[2013-03-29 12:32:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera
[2013-04-21 12:43:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.NOWAK\Dane aplikacji\Opera
[2013-05-19 11:56:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ArcaBit
[2013-01-19 17:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVAST Software
[2013-01-17 13:37:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite
[2013-02-03 22:29:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InstallMate
[2013-01-17 13:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IObit
[2013-04-22 11:40:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Package Cache
[2013-02-03 22:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\RightClick
[2013-02-08 15:31:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft
[2013-05-19 14:36:52 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Shared Space
[2013-01-17 14:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\by Barbje Keller
[2013-03-01 19:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Capcom
[2013-03-04 15:27:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\DAEMON Tools Lite
[2013-02-07 15:22:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1
[2013-04-24 10:34:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Free Download Manager
[2013-03-01 19:12:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\GetRightToGo
[2013-01-17 13:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\IObit
[2013-03-15 22:39:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\IObit Apps
[2013-02-01 13:38:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\OpenOffice.org
[2013-01-17 13:23:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Opera
[2013-08-09 20:27:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings
[2013-02-03 22:27:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\SendSpace
[2013-03-04 18:41:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Stellarium
[2013-08-05 16:54:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\uTorrent

========== Purity Check ==========



< End of report >
[/log]

[log]

OTL Extras logfile created on: 2013-09-02 20:58:43 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Komputer\Pulpit
Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 6.0.2900.5512)
Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd

511,23 Mb Total Physical Memory | 91,19 Mb Available Physical Memory | 17,84% Memory free
1,22 Gb Paging File | 0,45 Gb Available in Paging File | 36,80% Paging File free
Paging file location(s): C:\pagefile.sys 768 1536 [binary data]

%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 30,27 Gb Total Space | 12,09 Gb Free Space | 39,94% Space Free | Partition Type: NTFS
Drive D: | 40,75 Gb Total Space | 7,14 Gb Free Space | 17,53% Space Free | Partition Type: NTFS
Drive E: | 40,76 Gb Total Space | 3,66 Gb Free Space | 8,99% Space Free | Partition Type: NTFS

Computer Name: NOWAK | User Name: Komputer | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

========== Extra Registry (SafeList) ==========


========== File Associations ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
.url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l

[HKEY_USERS\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Classes\<extension>]
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)

========== Shell Spawning ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*
exefile [open] -- "%1" %*
htmlfile [edit] -- Reg Error: Key error.
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [ChomikBox.Upload] -- "C:\Program Files\ChomikBox\\ChomikBox.exe" -u"%1" ( )
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [napiprojekt] -- "C:\Program Files\NapiProjekt\napisy.exe" "%1" ()
Directory [napiprojekt0] -- "C:\Program Files\NapiProjekt\napisy.exe" "%1" -pobierz_ang ()
Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)

========== Security Center Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"FirstRunDisabled" = 1
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"UpdatesDisableNotify" = 0
"AntiVirusOverride" = 0
"FirewallOverride" = 0

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]

========== System Restore Settings ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2

========== Firewall Settings ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0

========== Authorized Applications List ==========

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation)
"C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software)
"C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation)
"C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.)
"C:\Program Files\Winamp\winamp.exe" = C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp -- (Nullsoft, Inc.)
"%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation)
"C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation)
"E:\MOTOGP\Launcher.exe" = E:\MOTOGP\Launcher.exe:*:Enabled:MotoGP 08


========== HKEY_LOCAL_MACHINE Uninstall List ==========

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0141D498-16DA-4221-A529-1D7A64BE8B05}" = OpenOffice.org 3.3
"{1270EE0A-2E34-4BB1-B0E7-CF8DB6F1FE75}" = IObit Apps Toolbar v7.4
"{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{26050F54-3928-4D9C-849A-C48A9E831E6F}" = ChomikBox
"{26A24AE4-039D-4CA4-87B4-2F83217011FF}" = Java 7 Update 11
"{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer
"{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{5C4ED859-875F-4299-AA2C-E0E393BDCD21}" = ScanSoft PaperPort 11
"{64CB2553-C109-4132-AA51-1F421B515FD1}" = Microsoft .NET Framework 1.1 Polish Language Pack
"{64FC0C98-B035-4530-B15D-3D30610B6DF1}" = HP Software Update
"{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}" = Brother MFL-Pro Suite DCP-195C
"{6C772996-BFF3-3C8C-860B-B3D48FF05D65}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{79361740-EAE3-11E2-9911-B8AC6F98CCE3}" = Google Earth Plug-in
"{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946
"{80BF3AE1-0992-4C5E-8C03-BE9A52A85205}" = Humalamaki
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8e70e4e1-06d7-470b-9f74-a51bef21088e}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106
"{8F45A7FB-2178-41A8-8ECC-1A11589A2DF9}" = ArcaBit Prerequistes
"{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12
"{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007
"{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007
"{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007
"{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007
"{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007
"{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007
"{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007
"{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007
"{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007
"{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007
"{92C7D009-A464-4948-A980-7A3E28CB2F49}" = Richard Burns Rally
"{A07BAED2-DA9A-436A-83F1-80BA23FA9E4B}" = 1400_Help
"{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1045-7B44-A95000000001}" = Adobe Reader 9.5.4 - Polish
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Panel sterowania NVIDIA 307.74
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Sterownik graficzny 307.74
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.53
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = Aktualizacje NVIDIA 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution
"{B9B28AD2-32A5-4D74-8857-8C96AA45BBAD}" = RP 2009 Shakedown
"{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{DCFD26A8-60A5-4C69-A52D-264D0386FDB3}" = Microsoft Xbox 360 Accessories 1.2
"{DE66E6E1-BFBC-4586-A03C-686598F4CA3C}" = 1400Trb
"{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106
"{EDAAC216-AC73-4152-9654-E12FE5A69F5D}_is1" = CBR Reader
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F11000CE-0010-0000-0000-074957833700}" = ABBYY FineReader 11 Corporate Edition
"{F1EC4151-805B-4097-B9BB-7D71A417AAF1}" = COMODO Internet Security Premium
"{FE77909E-B782-4554-A92A-4D887CEF0ACC}_is1" = ALLMediaServer
"6A1545AE87FC8D98ACA7539CE7AA69DF2A5C7E1C" = Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ALL YouTube Downloader_is1" = ALL YouTube Downloader
"ALLPlayer_is1" = ALLPlayer V5.X
"CCleaner" = CCleaner
"DAEMON Tools Lite" = DAEMON Tools Lite
"Defraggler" = Defraggler
"ENTERPRISE" = Microsoft Office Enterprise 2007
"Free Download Manager_is1" = Free Download Manager 3.9.2
"GIMP-2_is1" = GIMP 2.8.4
"Hattrick Organizer" = Hattrick Organizer (remove only)
"Humalamaki" = RBR Stage Humalamaki
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platforma Menedżera urządzeń
"InstallShield_{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946
"KLiteCodecPack_is1" = K-Lite Codec Pack 9.8.0 (Full)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware wersja 1.75.0.1300
"Mozilla Firefox 19.0.2 (x86 pl)" = Mozilla Firefox 19.0.2 (x86 pl)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NapiProjekt_is1" = NapiProjekt 2.0.0 (build 2151)
"Nero - Burning Rom!UninstallKey" = Nero OEM
"Opera 12.16.1860" = Opera 12.16
"PIT Format 2012_is1" = PIT Format 2012
"RealAlt_is1" = Real Alternative 1.9.0 Lite
"RP 2009 Shakedown" = RBR Stage RP 2009 Shakedown
"Stellarium_is1" = Stellarium 0.12.0
"uTorrent" = µTorrent
"Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
"Winamp" = Winamp
"Windows Media Format Runtime" = Windows Media Format Runtime
"Windows XP Service Pack" = Windows XP Service Pack 3
"WinRAR archiver" = WinRAR 4.20 (32-bitowy)

========== HKEY_USERS Uninstall List ==========

[HKEY_USERS\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"RBR WRC Irelan 2009 Skins Pack" = RBR WRC Irelan 2009 Skins Pack
"RBR WRC Spain 2009 Skins Pack" = RBR WRC Spain 2009 Skins Pack
"Winamp Detect" = Detektor Winampa
"WRC GB 2009 Skins Pack" = WRC GB 2009 Skins Pack

========== Last 20 Event Log Errors ==========

[ Application Events ]
Error - 2013-08-20 08:03:27 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/20 14:03:27.421]: [00000244]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-20 08:03:28 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/20 14:03:28.437]: [00000244]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-24 04:48:39 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/24 10:48:38.671]: [00000212]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-24 04:48:40 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/24 10:48:40.656]: [00000212]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-24 04:48:41 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/24 10:48:41.687]: [00000212]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-25 08:17:10 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/25 14:17:10.062]: [00000196]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-25 12:36:25 | Computer Name = NOWAK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca opera.exe, wersja 12.16.1860.0, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Error - 2013-08-27 13:54:38 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001
Description = STI BrtSTI: [2013/08/27 19:54:36.500]: [00002004]: CUsbScnDev: DeviceIoControl
Illegal response

Error - 2013-08-28 15:30:07 | Computer Name = NOWAK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca javaw.exe, wersja 7.0.110.21, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

Error - 2013-08-31 12:38:14 | Computer Name = NOWAK | Source = Application Hang | ID = 1002
Description = Aplikacja zawieszająca WINWORD.EXE, wersja 12.0.4518.1014, moduł zawieszenia
hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000.

[ OSession Events ]
Error - 2013-06-16 09:47:52 | Computer Name = NOWAK | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2873
seconds with 1320 seconds of active time. This session ended with a crash.

[ System Events ]
Error - 2013-09-02 03:19:32 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038
Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser
z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić
się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie
Microsoft
Management Console (MMC).

Error - 2013-09-02 03:19:32 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego
błędu: %%1069

Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = NetBT | ID = 4321
Description = Nie można zarejestrować nazwy „NOWAK :0” w interfejsie o
adresie IP 192.168.1.10. Komputer o adresie IP 192.168.1.11 nie zezwolił na przejęcie
tej nazwy przez ten komputer.

Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = NetBT | ID = 4321
Description = Nie można zarejestrować nazwy „NOWAK :20” w interfejsie o
adresie IP 192.168.1.10. Komputer o adresie IP 192.168.1.11 nie zezwolił na przejęcie
tej nazwy przez ten komputer.

Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = Server | ID = 2505
Description = Serwer nie mógł utworzyć powiązania do transportu \Device\NetBT_Tcpip_{D8B63319-8AE4-4BE8-841A-0E1C04AB69E9},
ponieważ inny komputer w sieci ma tę samą nazwę. Nie można uruchomić serwera.

Error - 2013-09-02 09:35:03 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038
Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser
z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić
się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie
Microsoft
Management Console (MMC).

Error - 2013-09-02 09:35:03 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego
błędu: %%1069

Error - 2013-09-02 11:41:24 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038
Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser
z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić
się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie
Microsoft
Management Console (MMC).

Error - 2013-09-02 11:41:24 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000
Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego
błędu: %%1069

Error - 2013-09-02 11:42:46 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7011
Description = Limit czasu (30000 milisekund) podczas oczekiwania na odpowiedź transakcji
z usługi NVSvc.


< End of report >
[/log]

 

[log]

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-09-02 22:45:18
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-8 WDC_WD1200JB-00GVC0 rev.08.02D08 111,79GB
Running: gmer.exe; Driver: C:\DOCUME~1\Komputer\USTAWI~1\Temp\uxtdqpow.sys


---- System - GMER 2.1 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwAdjustPrivilegesToken [0xEE9874D6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwClose [0xEE98885A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwConnectPort [0xEE986786]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateFile [0xEE987104]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateKey [0xEE987E9E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateSection [0xEE986E96]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateSymbolicLinkObject [0xEE98985E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateThread [0xEE986130]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDeleteKey [0xEE9876CA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDeleteValueKey [0xEE987928]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDuplicateObject [0xEE985F1A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwEnumerateKey [0xEE988970]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwEnumerateValueKey [0xEE988B84]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwLoadDriver [0xEE989264]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwMakeTemporaryObject [0xEE986A6A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwNotifyChangeKey [0xEE989B30]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwNotifyChangeMultipleKeys [0xEE98872E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenFile [0xEE9872FC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenKey [0xEE987D8C]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenProcess [0xEE985B20]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenSection [0xEE986D1E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenThread [0xEE985D38]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryKey [0xEE988CF6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryMultipleValueKey [0xEE988FAA]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryValueKey [0xEE988E28]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwRenameKey [0xEE988484]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetSecurityObject [0xEE987BB0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetSystemInformation [0xEE989564]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetValueKey [0xEE9881C0]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwShutdownSystem [0xEE9869D4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSystemDebugControl [0xEE986C0A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwTerminateProcess [0xEE986566]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwTerminateThread [0xEE986334]

---- Kernel code sections - GMER 2.1 ----

.text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF30153C0, 0x84E14A, 0xE8000020]

---- User code sections - GMER 2.1 ----

.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\csrss.exe[728] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 5 Bytes JMP 100015D0 C:\WINDOWS\system32\cmdcsr.dll
.text C:\WINDOWS\system32\csrss.exe[728] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 5 Bytes JMP 10001A50 C:\WINDOWS\system32\cmdcsr.dll
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[800] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\services.exe[800] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A
.text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\services.exe[800] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\services.exe[800] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\services.exe[800] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\services.exe[800] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [72, 71] {JB 0x73}
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [6F, 71]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A2, 71]
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AA0001
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719A000A
.text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7197000A
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718E000A
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7194000A
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [90, 71]
.text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 7179000A
.text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717C000A
.text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7176000A
.text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 717F000A
.text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7182000A
.text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7188000A
.text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7185000A
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[972] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A
.text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [6F, 71]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [6C, 71]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A3, 71]
.text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7197000A
.text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7194000A
.text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 7176000A
.text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7179000A
.text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7173000A
.text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 717C000A
.text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 717F000A
.text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7185000A
.text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7182000A
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718B000A
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7191000A
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [8D, 71]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[1048] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A
.text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\svchost.exe[1048] rpcss.dll!WhichService 76A63C84 8 Bytes [20, 30, 01, 10, E0, 2D, 01, ...] {AND [EAX], DH; ADD [EAX], EDX; LOOPNZ 0x33; ADD [EAX], EDX}
.text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1144] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 00401E70 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
.text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1144] ntdll.dll!NtCreateFile 7C90D090 5 Bytes JMP 004453F0 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[1176] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A
.text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe[1436] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 00401200 C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
.text C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe[1436] ntdll.dll!NtCreateFile 7C90D090 5 Bytes JMP 00401000 C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [74, 71] {JZ 0x73}
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [71, 71] {JNO 0x73}
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719C000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7199000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7190000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7196000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [92, 71]
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7181000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7184000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718A000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7187000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717B000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717E000A
.text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7178000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [73, 71] {JAE 0x73}
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [70, 71] {JO 0x73}
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A3, 71]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719B000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7198000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718F000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7195000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [91, 71]
.text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717A000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717D000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7177000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7180000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7183000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7189000A
.text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7186000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]
.text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Program Files\COMODO\COMODO Internet Security\cis.exe[3452] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 0040AA50 C:\Program Files\COMODO\COMODO Internet Security\cis.exe
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73}
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73}
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10}
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX}
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E]
.text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71]

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys
AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys
AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys
AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Control\Video\{CF8E2FC3-DB4F-4676-8121-BB5165B88BE6}\0000@D3D_\x3332\x3331 2089309684
Reg HKLM\SYSTEM\ControlSet003\Control\Video\{CF8E2FC3-DB4F-4676-8121-BB5165B88BE6}\0000@D3D_\x3332\x3331 2089309684

---- EOF - GMER 2.1 ----
[/log]

Natsuki Kuga
komentarz
komentarz

1. Do OTL w okno Własne opcje skanowania/Skrypt wklej:


:OTL
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.goo...ts.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL
IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.goo...ts.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003..\Run: [ASRSetup] F:\ASRSetup.exe File not found
O20 - AppInit_DLLs: (c:\progra~1\browse~1\sprote~1.dll) - File not found

:Files
C:\Program Files\Common Files\Spigot\Search Settings
C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings

Kliknij Wykonaj skrypt, pokaż raport.

2. Użyj AdwCleaner z opcji Usuń. Pokaż raport.

3. Pokaż zestaw nowych logów z OTL.

 

Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!

Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.

×
×
  • Dodaj nową pozycję...

Powiadomienie o plikach cookie

Strona wykorzystuje pliki cookies w celu prawidłowego świadczenia usług i wygody użytkowników. Warunki przechowywania i dostępu do plików cookies możesz zmienić w ustawieniach przeglądarki.