alonso utworzono 2 września 2013 utworzono 2 września 2013 (edytowane) Od pewnego czasu mam problem z komputerem. Czasami uruchamia się szybko ale bardzo często trwa to dość długo . Zdarza się, że giną wszystkie ikony na pulpicie - widoczna jest tylko tapeta. Ostatnio również pulpit jakby był zablokowany tzn. nie istnieje możliwość kliknięcia na ikonkę. [log] OTL logfile created on: 2013-09-02 20:58:43 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Komputer\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,23 Mb Total Physical Memory | 91,19 Mb Available Physical Memory | 17,84% Memory free 1,22 Gb Paging File | 0,45 Gb Available in Paging File | 36,80% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,27 Gb Total Space | 12,09 Gb Free Space | 39,94% Space Free | Partition Type: NTFS Drive D: | 40,75 Gb Total Space | 7,14 Gb Free Space | 17,53% Space Free | Partition Type: NTFS Drive E: | 40,76 Gb Total Space | 3,66 Gb Free Space | 8,99% Space Free | Partition Type: NTFS Computer Name: NOWAK | User Name: Komputer | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Processes (SafeList) ========== PRC - [2013-09-02 20:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe PRC - [2013-08-08 19:33:48 | 001,303,360 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe PRC - [2013-08-08 19:33:48 | 000,807,800 | ---- | M] (Spigot, Inc.) -- C:\Program Files\Application Updater\ApplicationUpdater.exe PRC - [2013-07-04 20:10:43 | 000,879,456 | ---- | M] (Opera Software) -- C:\Program Files\Opera\opera.exe PRC - [2013-06-18 17:15:51 | 004,785,848 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe PRC - [2013-06-18 17:15:26 | 009,036,504 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cis.exe PRC - [2013-06-18 17:15:26 | 001,839,832 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe PRC - [2013-06-18 17:15:26 | 001,460,952 | ---- | M] (COMODO) -- C:\Program Files\COMODO\COMODO Internet Security\cistray.exe PRC - [2013-01-19 17:21:49 | 000,170,912 | ---- | M] (Oracle Corporation) -- C:\Program Files\Java\jre7\bin\jqs.exe PRC - [2012-07-19 16:07:51 | 000,821,840 | ---- | M] (ABBYY) -- C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe PRC - [2008-04-14 23:51:18 | 001,035,264 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2004-09-29 13:14:36 | 000,069,632 | ---- | M] (HP) -- C:\WINDOWS\system32\HPZipm12.exe========== Modules (No Company Name) ========== MOD - [2013-08-21 16:53:42 | 016,166,280 | ---- | M] () -- C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll MOD - [2013-07-04 20:11:05 | 000,835,584 | ---- | M] () -- C:\Program Files\Opera\gstreamer\gstreamer.dll MOD - [2013-07-04 20:11:05 | 000,312,832 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstoggdec.dll MOD - [2013-07-04 20:11:05 | 000,158,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstffmpegcolorspace.dll MOD - [2013-07-04 20:11:05 | 000,101,888 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwebmdec.dll MOD - [2013-07-04 20:11:05 | 000,096,256 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstcoreplugins.dll MOD - [2013-07-04 20:11:05 | 000,094,208 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioresample.dll MOD - [2013-07-04 20:11:05 | 000,093,696 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstaudioconvert.dll MOD - [2013-07-04 20:11:05 | 000,073,728 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwavparse.dll MOD - [2013-07-04 20:11:05 | 000,067,072 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdirectsound.dll MOD - [2013-07-04 20:11:05 | 000,062,976 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstdecodebin2.dll MOD - [2013-07-04 20:11:05 | 000,057,344 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstautodetect.dll MOD - [2013-07-04 20:11:05 | 000,038,912 | ---- | M] () -- C:\Program Files\Opera\gstreamer\plugins\gstwaveform.dll MOD - [2013-06-18 17:15:33 | 002,463,448 | ---- | M] () -- C:\Program Files\COMODO\COMODO Internet Security\cmdavcen.dll MOD - [2009-01-09 18:10:52 | 000,139,264 | ---- | M] () -- C:\Program Files\Brother\BrUtilities\BrLogAPI.dll MOD - [2008-04-14 23:50:38 | 000,014,336 | ---- | M] () -- C:\WINDOWS\system32\msdmo.dll========== Services (SafeList) ========== SRV - File not found [Disabled | Stopped] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - [2013-08-21 16:53:46 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\WINDOWS\system32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2013-08-08 19:33:48 | 000,807,800 | ---- | M] (Spigot, Inc.) [Auto | Running] -- C:\Program Files\Application Updater\ApplicationUpdater.exe -- (Application Updater) SRV - [2013-06-18 17:15:51 | 004,785,848 | ---- | M] (COMODO) [Auto | Running] -- C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe -- (cmdAgent) SRV - [2013-06-18 17:15:27 | 000,127,192 | ---- | M] (COMODO) [On_Demand | Stopped] -- C:\Program Files\COMODO\COMODO Internet Security\cmdvirth.exe -- (cmdvirth) SRV - [2013-06-02 22:52:50 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2013-01-19 17:21:49 | 000,170,912 | ---- | M] (Oracle Corporation) [Auto | Running] -- C:\Program Files\Java\jre7\bin\jqs.exe -- (JavaQuickStarterService) SRV - [2013-01-03 13:43:58 | 001,259,448 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2012-07-19 16:07:51 | 000,821,840 | ---- | M] (ABBYY) [Auto | Running] -- C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Corporate.11.0) SRV - [2004-09-29 13:14:36 | 000,069,632 | ---- | M] (HP) [Auto | Running] -- C:\WINDOWS\system32\HPZipm12.exe -- (Pml Driver HPZ12)========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- -- (WDICA) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Stopped] -- -- (PDCOMP) DRV - File not found [Kernel | System | Stopped] -- -- (PCIDump) DRV - File not found [Kernel | System | Stopped] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Stopped] -- -- (i2omgmt) DRV - File not found [Kernel | System | Stopped] -- -- (Changer) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\Drivers\AsrCDDrv.sys -- (AsrCDDrv) DRV - [2013-06-18 17:16:22 | 000,099,520 | ---- | M] (COMODO) [Kernel | Boot | Running] -- C:\WINDOWS\system32\drivers\inspect.sys -- (Inspect) DRV - [2013-06-18 17:16:22 | 000,032,816 | ---- | M] (COMODO) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\cmdhlp.sys -- (cmdHlp) DRV - [2013-06-18 17:16:21 | 000,593,408 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmdGuard.sys -- (cmdGuard) DRV - [2013-06-18 17:16:20 | 000,018,528 | ---- | M] (COMODO) [File_System | System | Running] -- C:\WINDOWS\system32\drivers\cmderd.sys -- (cmderd) DRV - [2013-01-17 13:37:19 | 000,242,240 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\dtsoftbus01.sys -- (dtsoftbus01) DRV - [2009-11-24 09:04:26 | 001,617,408 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2009-06-26 09:29:34 | 001,656,960 | R--- | M] (Creative) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (AMBFilt) DRV - [2008-12-02 08:56:00 | 001,389,056 | R--- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (MonFilt) DRV - [2008-10-30 15:14:20 | 000,117,888 | R--- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\Rtenicxp.sys -- (RTLE8023xp) DRV - [2006-08-08 10:54:30 | 000,182,528 | R--- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiHFF04.sys -- (SaiHFF04) DRV - [2006-08-08 10:54:30 | 000,016,512 | R--- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\WINDOWS\system32\drivers\SaiIFF04.sys -- (SaiIFF04) DRV - [2006-07-02 00:32:26 | 000,043,520 | ---- | M] (Advanced Micro Devices) [Kernel | System | Running] -- C:\WINDOWS\system32\drivers\AmdK8.sys -- (AmdK8) DRV - [2001-08-17 23:51:32 | 000,018,688 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\WINDOWS\system32\drivers\irsir.sys -- (irsir)========== Standard Registry (SafeList) ==================== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/?utm_source=is IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.interia.pl/?utm_source=is IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\URLSearchHook: {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.) IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes,DefaultScope = {BB74DE59-BC4C-4172-9AC4-73315F71CFFE} IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.good-results.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.defaultenginename,S: S", "" FF - prefs.js..browser.search.defaultthis.engineName: "" FF - prefs.js..browser.search.defaulturl: "" FF - prefs.js..browser.search.order.1: "" FF - prefs.js..browser.search.order.1,S: S", "" FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&ilc=12&type=902615" FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.search.selectedEngine,S: S", "" FF - prefs.js..browser.startup.homepage: "http://www.interia.pl/?utm_source=is" FF - prefs.js..extensions.enabledAddons: IplextoALL%40ALLPlayer.org:0.7.0 FF - prefs.js..extensions.enabledAddons: YoutubeDownloader%40PeterOlayev.com:2.0.6 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0.2 FF - prefs.js..keyword.URL: "http://search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&ilc=12&type=902615&p=" FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "" FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: "" FF - prefs.js..browser.startup.homepage: "" FF - prefs.js..sweetim.toolbar.previous.keyword.URL: "" FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32_11_8_800_94.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.11.2: C:\WINDOWS\system32\npDeployJava1.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.11.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.10411.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@real.com/nppl3260;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nppl3260.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nprpjplug;version=6.0.12.69: C:\Program Files\Real Alternative\browser\plugins\nprpjplug.dll (RealNetworks, Inc.) FF - HKLM\Software\MozillaPlugins\@real.com/nsJSRealPlayerPlugin;version=: File not found FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.153\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013-06-02 22:53:00 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2013-02-16 14:30:26 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Extensions [2013-08-31 19:49:23 | 000,000,000 | ---D | M] (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions [2013-03-26 12:01:11 | 000,010,043 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\IplextoALL@ALLPlayer.org.xpi [2013-08-31 19:49:23 | 000,032,675 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\YoutubeDownloader@PeterOlayev.com.xpi [2013-03-26 11:59:01 | 000,221,336 | ---- | M] () (No name found) -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2013-08-09 20:26:32 | 000,000,904 | ---- | M] () -- C:\Documents and Settings\Komputer\Dane aplikacji\Mozilla\Firefox\Profiles\d0m7nc6h.default\searchplugins\yahoo.xml [2013-06-02 22:51:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions [2013-06-02 22:52:59 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll [2013-06-02 22:52:22 | 000,002,980 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\allegro-pl.xml [2013-06-02 22:52:22 | 000,001,619 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\fbc-pl.xml [2013-06-02 22:52:21 | 000,001,130 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\merlin-pl.xml [2013-06-02 22:52:21 | 000,001,071 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\pwn-pl.xml [2013-06-02 22:52:21 | 000,001,396 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-pl.xml [2013-06-02 22:52:20 | 000,001,896 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wp-pl.xml========== Chrome ========== CHR - homepage: http://www.interia.pl/?utm_source=is O1 HOSTS File: ([2001-10-26 17:45:16 | 000,000,742 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (IObit Apps Toolbar) - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.) O2 - BHO: (ALLYouTubeDownloader) - {61DB16C5-B733-43F4-872E-B20DC9E72740} - C:\Program Files\ALLYouTubeDownloader\ALLYouTubeDownloader.dll (ALLCinema Ltd.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation) O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (IplexToALLPlayer) - {DF925EF3-7A87-44E4-9CAF-8D7B280BF616} - C:\Program Files\ALLPlayer\Iplex\IplexToALLPlayer.dll (ALLCinema Ltd.) O3 - HKLM\..\Toolbar: (IObit Apps Toolbar) - {03EB0E9C-7A91-4381-A220-9B52B641CDB1} - C:\Program Files\IObit Apps Toolbar\IE\7.4\iobitappsToolbarIE.dll (Spigot, Inc.) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [COMODO Internet Security] C:\Program Files\COMODO\COMODO Internet Security\cistray.exe (COMODO) O4 - HKLM..\Run: [NvCplDaemon] C:\WINDOWS\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [NvMediaCenter] C:\WINDOWS\System32\nvmctray.dll (NVIDIA Corporation) O4 - HKLM..\Run: [nwiz] C:\Program Files\NVIDIA Corporation\nview\nwiz.exe () O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003..\Run: [ASRSetup] F:\ASRSetup.exe File not found O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: Pobierz plik wideo w FDM - C:\Program Files\Free Download Manager\dlfvideo.htm () O8 - Extra context menu item: Pobierz w FDM - C:\Program Files\Free Download Manager\dllink.htm () O8 - Extra context menu item: Pobierz wszystkie pliki w FDM - C:\Program Files\Free Download Manager\dlall.htm () O8 - Extra context menu item: Pobierz zaznaczone pliki w FDM - C:\Program Files\Free Download Manager\dlselected.htm () O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.1.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D8B63319-8AE4-4BE8-841A-0E1C04AB69E9}: DhcpNameServer = 192.168.1.1 192.168.1.1 O20 - AppInit_DLLs: (c:\progra~1\browse~1\sprote~1.dll) - File not found O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O24 - Desktop Components:0 (Moja bieżąca strona główna) - About:Home O24 - Desktop WallPaper: E:\bez tytułu.bmp O24 - Desktop BackupWallPaper: E:\bez tytułu.bmp O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2013-01-17 13:02:42 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2010-06-07 22:31:46 | 000,000,000 | ---D | M] - D:\autorun.inf -- [ NTFS ] O32 - AutoRun File - [2010-06-07 22:31:46 | 000,000,000 | ---D | M] - E:\autorun.inf -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)========== Files/Folders - Created Within 30 Days ========== [2013-09-02 21:02:06 | 000,663,128 | ---- | C] (Duplex Secure Ltd.) -- C:\Documents and Settings\Komputer\Pulpit\SPTDinst-v183-x86.exe [2013-09-02 20:55:56 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe [2013-08-25 12:02:13 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\MachineheadSoftware [2013-08-25 12:02:08 | 000,000,000 | ---D | C] -- C:\Program Files\mhead32 [2013-08-25 12:01:44 | 000,364,544 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\Setup1.exe [2013-08-25 12:01:36 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE [2013-08-25 12:01:26 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14 [2013-08-25 11:40:59 | 000,000,000 | RH-D | C] -- C:\Documents and Settings\Komputer\Recent [2013-08-20 20:03:28 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Pulpit\WOP_Katalog2013_PL [2013-08-09 20:26:59 | 000,000,000 | ---D | C] -- C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings [2013-08-09 20:26:28 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater [2013-08-09 20:26:24 | 000,000,000 | ---D | C] -- C:\Program Files\IObit Apps Toolbar [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Komputer\Pulpit\*.tmp files -> C:\Documents and Settings\Komputer\Pulpit\*.tmp -> ]========== Files - Modified Within 30 Days ========== [2013-09-02 21:29:15 | 000,001,040 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job [2013-09-02 21:02:10 | 000,663,128 | ---- | M] (Duplex Secure Ltd.) -- C:\Documents and Settings\Komputer\Pulpit\SPTDinst-v183-x86.exe [2013-09-02 20:56:10 | 000,368,554 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\gmer.zip [2013-09-02 20:55:58 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Documents and Settings\Komputer\Pulpit\OTL.exe [2013-09-02 20:52:04 | 000,000,930 | ---- | M] () -- C:\WINDOWS\tasks\Adobe Flash Player Updater.job [2013-09-02 19:29:17 | 000,001,036 | ---- | M] () -- C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job [2013-09-02 18:42:41 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Cache Builder {0FB77674-7905-4F34-A362-C5A9A26F8CF9}.job [2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Update {A6D52E4F-569B-4756-B3D8-DF217313DA85}.job [2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Signature Update {B9D5C6F9-17D2-4917-8BD0-614BAA1C6A59}.job [2013-09-02 17:41:27 | 000,000,440 | ---- | M] () -- C:\WINDOWS\tasks\COMODO Scan {F140D794-60B6-4F00-9235-D6457AA25B22}.job [2013-09-02 17:41:07 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013-09-01 15:10:56 | 000,002,034 | ---- | M] () -- C:\WINDOWS\System32\SaiCFF04-7F4FF365-1416-479D-B166-5FED9B8417E5.pr0 [2013-08-28 20:42:47 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013-08-27 15:46:25 | 000,436,322 | ---- | M] () -- C:\WINDOWS\System32\perfh015.dat [2013-08-27 15:46:25 | 000,380,486 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2013-08-27 15:46:25 | 000,067,298 | ---- | M] () -- C:\WINDOWS\System32\perfc015.dat [2013-08-27 15:46:25 | 000,052,900 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2013-08-25 12:01:44 | 000,364,544 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\Setup1.exe [2013-08-25 12:01:36 | 000,073,216 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\ST6UNST.EXE [2013-08-25 12:00:56 | 001,597,036 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14.zip [2013-08-21 16:53:43 | 000,692,104 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerApp.exe [2013-08-21 16:53:43 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\WINDOWS\System32\FlashPlayerCPLApp.cpl [2013-08-19 21:00:34 | 000,015,436 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\RAP.m3u [2013-08-19 19:03:23 | 000,100,783 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\arturkrolbrytow.jpg [2013-08-17 21:04:21 | 055,740,683 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\Bob_Air_-_instrumentale_Vol.2.zip [2013-08-11 17:00:38 | 000,001,805 | ---- | M] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\recently-used.xbel [2013-08-06 11:27:14 | 000,162,063 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\oswiadczenie.pdf [2013-08-06 11:26:08 | 000,163,206 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\podanie.pdf [2013-08-05 21:16:21 | 000,060,224 | ---- | M] () -- C:\Documents and Settings\Komputer\Pulpit\f5d189885a48d71e25f50fab86ab8d0a.jpg [1 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] [1 C:\Documents and Settings\Komputer\Pulpit\*.tmp files -> C:\Documents and Settings\Komputer\Pulpit\*.tmp -> ]========== Files Created - No Company Name ========== [2013-09-02 20:56:10 | 000,368,554 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\gmer.zip [2013-08-25 12:00:54 | 001,597,036 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\spoke_length_calculator_32bit_install1_1_14.zip [2013-08-19 21:00:34 | 000,015,436 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\RAP.m3u [2013-08-19 19:03:23 | 000,100,783 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\arturkrolbrytow.jpg [2013-08-17 20:48:59 | 055,740,683 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\Bob_Air_-_instrumentale_Vol.2.zip [2013-08-11 17:00:38 | 000,001,805 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\recently-used.xbel [2013-08-10 13:48:51 | 000,002,034 | ---- | C] () -- C:\WINDOWS\System32\SaiCFF04-7F4FF365-1416-479D-B166-5FED9B8417E5.pr0 [2013-08-06 13:17:26 | 000,191,885 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\dowod 001.jpg [2013-08-06 13:17:26 | 000,175,389 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\dowod2 001.jpg [2013-08-06 13:17:15 | 000,162,063 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\oswiadczenie.pdf [2013-08-06 13:17:08 | 000,163,206 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\podanie.pdf [2013-08-05 21:16:20 | 000,060,224 | ---- | C] () -- C:\Documents and Settings\Komputer\Pulpit\f5d189885a48d71e25f50fab86ab8d0a.jpg [2013-06-20 13:13:02 | 000,003,260 | ---- | C] () -- C:\WINDOWS\System32\drivers\fvstore.dat [2013-03-13 19:09:41 | 000,178,688 | ---- | C] () -- C:\WINDOWS\System32\unrar.dll [2013-02-15 13:35:13 | 001,474,832 | ---- | C] () -- C:\WINDOWS\System32\drivers\sfi.dat [2013-02-08 15:34:22 | 000,000,050 | ---- | C] () -- C:\WINDOWS\System32\bridf08b.dat [2013-02-08 15:34:19 | 000,000,404 | ---- | C] () -- C:\WINDOWS\BRWMARK.INI [2013-02-08 15:31:39 | 000,031,767 | ---- | C] () -- C:\WINDOWS\maxlink.ini [2013-01-20 14:13:41 | 000,007,168 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2013-01-17 17:42:09 | 000,644,608 | ---- | C] () -- C:\WINDOWS\System32\xvidcore.dll [2013-01-17 17:42:09 | 000,258,048 | ---- | C] () -- C:\WINDOWS\System32\libFLAC.dll [2013-01-17 15:50:57 | 000,207,360 | ---- | C] () -- C:\WINDOWS\System32\evrprop.dll [2013-01-17 15:50:02 | 000,080,384 | ---- | C] () -- C:\WINDOWS\System32\mkzlib.dll [2013-01-17 15:50:00 | 000,024,576 | ---- | C] () -- C:\WINDOWS\System32\mkunicode.dll [2013-01-17 15:47:33 | 000,000,116 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2013-01-17 15:17:14 | 000,000,133 | ---- | C] () -- C:\Documents and Settings\Komputer\Ustawienia lokalne\Dane aplikacji\fusioncache.dat [2013-01-17 15:15:16 | 001,998,848 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04.Dll [2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_10.dll [2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0C.dll [2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0A.dll [2013-01-17 15:15:16 | 000,007,680 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_07.dll [2013-01-17 15:15:16 | 000,006,656 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_09.dll [2013-01-17 15:15:16 | 000,006,656 | R--- | C] () -- C:\WINDOWS\System32\SaiCFF04_0402.dll [2013-01-17 13:52:51 | 000,004,293 | ---- | C] () -- C:\WINDOWS\ODBCINST.INI [2013-01-17 13:51:27 | 000,217,656 | ---- | C] () -- C:\WINDOWS\System32\FNTCACHE.DAT [2013-01-17 13:19:27 | 000,040,960 | ---- | C] () -- C:\Program Files\Uninstall_CDS.exe [2013-01-17 13:15:13 | 001,073,008 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb1.bin [2013-01-17 13:15:13 | 001,073,008 | ---- | C] () -- C:\WINDOWS\System32\nvdrsdb0.bin [2013-01-17 13:15:13 | 000,000,001 | ---- | C] () -- C:\WINDOWS\System32\nvdrssel.bin [2013-01-17 13:14:50 | 002,816,600 | ---- | C] () -- C:\WINDOWS\System32\nvdata.data [2013-01-17 13:05:38 | 000,002,048 | --S- | C] () -- C:\WINDOWS\bootstat.dat [2013-01-17 12:58:59 | 000,021,856 | ---- | C] () -- C:\WINDOWS\System32\emptyregdb.dat========== ZeroAccess Check ========== [2013-01-17 15:07:35 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2008-04-14 23:50:48 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2008-04-14 23:50:32 | 000,472,064 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008-04-14 23:50:58 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both========== LOP Check ========== [2013-03-29 12:32:28 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator\Dane aplikacji\Opera [2013-04-21 12:43:55 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Administrator.NOWAK\Dane aplikacji\Opera [2013-05-19 11:56:01 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ArcaBit [2013-01-19 17:23:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\AVAST Software [2013-01-17 13:37:54 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\DAEMON Tools Lite [2013-02-03 22:29:05 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\InstallMate [2013-01-17 13:31:27 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\IObit [2013-04-22 11:40:08 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Package Cache [2013-02-03 22:28:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\RightClick [2013-02-08 15:31:39 | 000,000,000 | ---D | M] -- C:\Documents and Settings\All Users\Dane aplikacji\ScanSoft [2013-05-19 14:36:52 | 000,000,000 | --SD | M] -- C:\Documents and Settings\All Users\Dane aplikacji\Shared Space [2013-01-17 14:46:31 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\by Barbje Keller [2013-03-01 19:03:59 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Capcom [2013-03-04 15:27:25 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\DAEMON Tools Lite [2013-02-07 15:22:47 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\e-Deklaracje.A1909296681C7ACEFE45687D3A64758C8659BF46.1 [2013-04-24 10:34:46 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Free Download Manager [2013-03-01 19:12:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\GetRightToGo [2013-01-17 13:31:22 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\IObit [2013-03-15 22:39:04 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\IObit Apps [2013-02-01 13:38:42 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\OpenOffice.org [2013-01-17 13:23:18 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Opera [2013-08-09 20:27:02 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings [2013-02-03 22:27:23 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\SendSpace [2013-03-04 18:41:32 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\Stellarium [2013-08-05 16:54:15 | 000,000,000 | ---D | M] -- C:\Documents and Settings\Komputer\Dane aplikacji\uTorrent========== Purity Check ========== < End of report > [/log] [log] OTL Extras logfile created on: 2013-09-02 20:58:43 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Documents and Settings\Komputer\Pulpit Windows XP Professional Edition Dodatek Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 6.0.2900.5512) Locale: 00000415 | Country: Polska | Language: PLK | Date Format: yyyy-MM-dd 511,23 Mb Total Physical Memory | 91,19 Mb Available Physical Memory | 17,84% Memory free 1,22 Gb Paging File | 0,45 Gb Available in Paging File | 36,80% Paging File free Paging file location(s): C:\pagefile.sys 768 1536 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files Drive C: | 30,27 Gb Total Space | 12,09 Gb Free Space | 39,94% Space Free | Partition Type: NTFS Drive D: | 40,75 Gb Total Space | 7,14 Gb Free Space | 17,53% Space Free | Partition Type: NTFS Drive E: | 40,76 Gb Total Space | 3,66 Gb Free Space | 8,99% Space Free | Partition Type: NTFS Computer Name: NOWAK | User Name: Komputer | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days========== Extra Registry (SafeList) ==================== File Associations ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* .html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software) .url [@ = InternetShortcut] -- rundll32.exe shdocvw.dll,OpenURL %l [HKEY_USERS\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Classes\<extension>] .html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)========== Shell Spawning ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%* exefile [open] -- "%1" %* htmlfile [edit] -- Reg Error: Key error. http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software) https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software) InternetShortcut [open] -- rundll32.exe shdocvw.dll,OpenURL %l piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [ChomikBox.Upload] -- "C:\Program Files\ChomikBox\\ChomikBox.exe" -u"%1" ( ) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Directory [napiprojekt] -- "C:\Program Files\NapiProjekt\napisy.exe" "%1" () Directory [napiprojekt0] -- "C:\Program Files\NapiProjekt\napisy.exe" "%1" -pobierz_ang () Directory [Winamp.Bookmark] -- "C:\Program Files\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.) Directory [Winamp.Enqueue] -- "C:\Program Files\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.) Directory [Winamp.Play] -- "C:\Program Files\Winamp\winamp.exe" "%1" (Nullsoft, Inc.) Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation) Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation) Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)========== Security Center Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "FirstRunDisabled" = 1 "AntiVirusDisableNotify" = 0 "FirewallDisableNotify" = 0 "UpdatesDisableNotify" = 0 "AntiVirusOverride" = 0 "FirewallOverride" = 0 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]========== System Restore Settings ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore] "DisableSR" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr] "Start" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService] "Start" = 2========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 0========== Authorized Applications List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List] "%windir%\system32\sessmgr.exe" = %windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019 -- (Microsoft Corporation) "C:\Program Files\Opera\opera.exe" = C:\Program Files\Opera\opera.exe:*:Enabled:Opera Internet Browser -- (Opera Software) "C:\Program Files\Microsoft Office\Office12\GROOVE.EXE" = C:\Program Files\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove -- (Microsoft Corporation) "C:\Program Files\uTorrent\uTorrent.exe" = C:\Program Files\uTorrent\uTorrent.exe:*:Enabled:µTorrent -- (BitTorrent, Inc.) "C:\Program Files\Winamp\winamp.exe" = C:\Program Files\Winamp\winamp.exe:*:Enabled:Winamp -- (Nullsoft, Inc.) "%windir%\Network Diagnostic\xpnetdiag.exe" = %windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000 -- (Microsoft Corporation) "C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe" = C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe:*:Enabled:Daemonu.exe -- (NVIDIA Corporation) "E:\MOTOGP\Launcher.exe" = E:\MOTOGP\Launcher.exe:*:Enabled:MotoGP 08========== HKEY_LOCAL_MACHINE Uninstall List ========== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{0141D498-16DA-4221-A529-1D7A64BE8B05}" = OpenOffice.org 3.3 "{1270EE0A-2E34-4BB1-B0E7-CF8DB6F1FE75}" = IObit Apps Toolbar v7.4 "{1798D459-6B8B-474B-868D-1229EADA3B95}" = Adobe AIR "{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 "{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = Multimedia Launcher "{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform "{26050F54-3928-4D9C-849A-C48A9E831E6F}" = ChomikBox "{26A24AE4-039D-4CA4-87B4-2F83217011FF}" = Java 7 Update 11 "{2BC2781A-F7F6-452E-95EB-018A522F1B2C}" = PaperPort Image Printer "{350C9415-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP "{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater "{5C4ED859-875F-4299-AA2C-E0E393BDCD21}" = ScanSoft PaperPort 11 "{64CB2553-C109-4132-AA51-1F421B515FD1}" = Microsoft .NET Framework 1.1 Polish Language Pack "{64FC0C98-B035-4530-B15D-3D30610B6DF1}" = HP Software Update "{6BF66AED-3EA4-4106-B240-5CE96C9B76B0}" = Brother MFL-Pro Suite DCP-195C "{6C772996-BFF3-3C8C-860B-B3D48FF05D65}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.51106 "{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable "{79361740-EAE3-11E2-9911-B8AC6F98CCE3}" = Google Earth Plug-in "{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946 "{80BF3AE1-0992-4C5E-8C03-BE9A52A85205}" = Humalamaki "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{8e70e4e1-06d7-470b-9f74-a51bef21088e}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.51106 "{8F45A7FB-2178-41A8-8ECC-1A11589A2DF9}" = ArcaBit Prerequistes "{90120000-0010-0415-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (Polish) 12 "{90120000-0015-0415-0000-0000000FF1CE}" = Microsoft Office Access MUI (Polish) 2007 "{90120000-0016-0415-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Polish) 2007 "{90120000-0018-0415-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Polish) 2007 "{90120000-0019-0415-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Polish) 2007 "{90120000-001A-0415-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Polish) 2007 "{90120000-001B-0415-0000-0000000FF1CE}" = Microsoft Office Word MUI (Polish) 2007 "{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007 "{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007 "{90120000-001F-0415-0000-0000000FF1CE}" = Microsoft Office Proof (Polish) 2007 "{90120000-002C-0415-0000-0000000FF1CE}" = Microsoft Office Proofing (Polish) 2007 "{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007 "{90120000-0044-0415-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Polish) 2007 "{90120000-006E-0415-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Polish) 2007 "{90120000-00A1-0415-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (Polish) 2007 "{90120000-00BA-0415-0000-0000000FF1CE}" = Microsoft Office Groove MUI (Polish) 2007 "{92C7D009-A464-4948-A980-7A3E28CB2F49}" = Richard Burns Rally "{A07BAED2-DA9A-436A-83F1-80BA23FA9E4B}" = 1400_Help "{A43BF6A5-D5F0-4AAA-BF41-65995063EC44}" = MSXML 6.0 Parser "{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper "{AC76BA86-7AD7-1045-7B44-A95000000001}" = Adobe Reader 9.5.4 - Polish "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = Panel sterowania NVIDIA 307.74 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Sterownik graficzny 307.74 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NView" = NVIDIA nView 136.53 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = Aktualizacje NVIDIA 1.10.8 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{B97CF5C3-0487-11D8-A36E-0050BAE317E1}" = DVD Solution "{B9B28AD2-32A5-4D74-8857-8C96AA45BBAD}" = RP 2009 Shakedown "{C9BED750-1211-4480-B1A5-718A3BE15525}" = REALTEK GbE & FE Ethernet PCI-E NIC Driver "{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1 "{DCFD26A8-60A5-4C69-A52D-264D0386FDB3}" = Microsoft Xbox 360 Accessories 1.2 "{DE66E6E1-BFBC-4586-A03C-686598F4CA3C}" = 1400Trb "{E824E81C-80A4-3DFF-B5F9-4842A9FF5F7F}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.51106 "{EDAAC216-AC73-4152-9654-E12FE5A69F5D}_is1" = CBR Reader "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F11000CE-0010-0000-0000-074957833700}" = ABBYY FineReader 11 Corporate Edition "{F1EC4151-805B-4097-B9BB-7D71A417AAF1}" = COMODO Internet Security Premium "{FE77909E-B782-4554-A92A-4D887CEF0ACC}_is1" = ALLMediaServer "6A1545AE87FC8D98ACA7539CE7AA69DF2A5C7E1C" = Pakiet sterowników systemu Windows - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0) "Adobe AIR" = Adobe AIR "Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "ALL YouTube Downloader_is1" = ALL YouTube Downloader "ALLPlayer_is1" = ALLPlayer V5.X "CCleaner" = CCleaner "DAEMON Tools Lite" = DAEMON Tools Lite "Defraggler" = Defraggler "ENTERPRISE" = Microsoft Office Enterprise 2007 "Free Download Manager_is1" = Free Download Manager 3.9.2 "GIMP-2_is1" = GIMP 2.8.4 "Hattrick Organizer" = Hattrick Organizer (remove only) "Humalamaki" = RBR Stage Humalamaki "InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Platforma Menedżera urządzeń "InstallShield_{79438F1E-DEC3-443D-9DCD-FECE2D68C605}" = IL-2 Sturmovik 1946 "KLiteCodecPack_is1" = K-Lite Codec Pack 9.8.0 (Full) "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware wersja 1.75.0.1300 "Mozilla Firefox 19.0.2 (x86 pl)" = Mozilla Firefox 19.0.2 (x86 pl) "MozillaMaintenanceService" = Mozilla Maintenance Service "NapiProjekt_is1" = NapiProjekt 2.0.0 (build 2151) "Nero - Burning Rom!UninstallKey" = Nero OEM "Opera 12.16.1860" = Opera 12.16 "PIT Format 2012_is1" = PIT Format 2012 "RealAlt_is1" = Real Alternative 1.9.0 Lite "RP 2009 Shakedown" = RBR Stage RP 2009 Shakedown "Stellarium_is1" = Stellarium 0.12.0 "uTorrent" = µTorrent "Wdf01007" = Microsoft Kernel-Mode Driver Framework Feature Pack 1.7 "Winamp" = Winamp "Windows Media Format Runtime" = Windows Media Format Runtime "Windows XP Service Pack" = Windows XP Service Pack 3 "WinRAR archiver" = WinRAR 4.20 (32-bitowy)========== HKEY_USERS Uninstall List ========== [HKEY_USERS\S-1-5-21-1229272821-1770027372-725345543-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "RBR WRC Irelan 2009 Skins Pack" = RBR WRC Irelan 2009 Skins Pack "RBR WRC Spain 2009 Skins Pack" = RBR WRC Spain 2009 Skins Pack "Winamp Detect" = Detektor Winampa "WRC GB 2009 Skins Pack" = WRC GB 2009 Skins Pack========== Last 20 Event Log Errors ========== [ Application Events ] Error - 2013-08-20 08:03:27 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/20 14:03:27.421]: [00000244]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-20 08:03:28 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/20 14:03:28.437]: [00000244]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-24 04:48:39 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/24 10:48:38.671]: [00000212]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-24 04:48:40 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/24 10:48:40.656]: [00000212]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-24 04:48:41 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/24 10:48:41.687]: [00000212]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-25 08:17:10 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/25 14:17:10.062]: [00000196]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-25 12:36:25 | Computer Name = NOWAK | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca opera.exe, wersja 12.16.1860.0, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2013-08-27 13:54:38 | Computer Name = NOWAK | Source = Brother BrLog | ID = 1001 Description = STI BrtSTI: [2013/08/27 19:54:36.500]: [00002004]: CUsbScnDev: DeviceIoControl Illegal response Error - 2013-08-28 15:30:07 | Computer Name = NOWAK | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca javaw.exe, wersja 7.0.110.21, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. Error - 2013-08-31 12:38:14 | Computer Name = NOWAK | Source = Application Hang | ID = 1002 Description = Aplikacja zawieszająca WINWORD.EXE, wersja 12.0.4518.1014, moduł zawieszenia hungapp, wersja 0.0.0.0, adres zawieszenia 0x00000000. [ OSession Events ] Error - 2013-06-16 09:47:52 | Computer Name = NOWAK | Source = Microsoft Office 12 Sessions | ID = 7001 Description = ID: 0, Application Name: Microsoft Office Word, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 2873 seconds with 1320 seconds of active time. This session ended with a crash. [ System Events ] Error - 2013-09-02 03:19:32 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038 Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie Microsoft Management Console (MMC). Error - 2013-09-02 03:19:32 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego błędu: %%1069 Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = NetBT | ID = 4321 Description = Nie można zarejestrować nazwy „NOWAK :0” w interfejsie o adresie IP 192.168.1.10. Komputer o adresie IP 192.168.1.11 nie zezwolił na przejęcie tej nazwy przez ten komputer. Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = NetBT | ID = 4321 Description = Nie można zarejestrować nazwy „NOWAK :20” w interfejsie o adresie IP 192.168.1.10. Komputer o adresie IP 192.168.1.11 nie zezwolił na przejęcie tej nazwy przez ten komputer. Error - 2013-09-02 09:35:02 | Computer Name = NOWAK | Source = Server | ID = 2505 Description = Serwer nie mógł utworzyć powiązania do transportu \Device\NetBT_Tcpip_{D8B63319-8AE4-4BE8-841A-0E1C04AB69E9}, ponieważ inny komputer w sieci ma tę samą nazwę. Nie można uruchomić serwera. Error - 2013-09-02 09:35:03 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038 Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie Microsoft Management Console (MMC). Error - 2013-09-02 09:35:03 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego błędu: %%1069 Error - 2013-09-02 11:41:24 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7038 Description = Usługa nvUpdatusService nie mogła zalogować się jako .\UpdatusUser z aktualnie skonfigurowanym hasłem z powodu następującego błędu: %%1330 Aby upewnić się, że usługa jest skonfigurowana właściwie, użyj przystawki Usługi w programie Microsoft Management Console (MMC). Error - 2013-09-02 11:41:24 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7000 Description = Nie można uruchomić usługi NVIDIA Update Service Daemon z powodu następującego błędu: %%1069 Error - 2013-09-02 11:42:46 | Computer Name = NOWAK | Source = Service Control Manager | ID = 7011 Description = Limit czasu (30000 milisekund) podczas oczekiwania na odpowiedź transakcji z usługi NVSvc. < End of report > [/log] [log] GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-09-02 22:45:18 Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-8 WDC_WD1200JB-00GVC0 rev.08.02D08 111,79GB Running: gmer.exe; Driver: C:\DOCUME~1\Komputer\USTAWI~1\Temp\uxtdqpow.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwAdjustPrivilegesToken [0xEE9874D6] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwClose [0xEE98885A] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwConnectPort [0xEE986786] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateFile [0xEE987104] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateKey [0xEE987E9E] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateSection [0xEE986E96] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateSymbolicLinkObject [0xEE98985E] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwCreateThread [0xEE986130] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDeleteKey [0xEE9876CA] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDeleteValueKey [0xEE987928] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwDuplicateObject [0xEE985F1A] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwEnumerateKey [0xEE988970] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwEnumerateValueKey [0xEE988B84] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwLoadDriver [0xEE989264] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwMakeTemporaryObject [0xEE986A6A] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwNotifyChangeKey [0xEE989B30] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwNotifyChangeMultipleKeys [0xEE98872E] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenFile [0xEE9872FC] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenKey [0xEE987D8C] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenProcess [0xEE985B20] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenSection [0xEE986D1E] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwOpenThread [0xEE985D38] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryKey [0xEE988CF6] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryMultipleValueKey [0xEE988FAA] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwQueryValueKey [0xEE988E28] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwRenameKey [0xEE988484] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetSecurityObject [0xEE987BB0] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetSystemInformation [0xEE989564] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSetValueKey [0xEE9881C0] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwShutdownSystem [0xEE9869D4] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwSystemDebugControl [0xEE986C0A] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwTerminateProcess [0xEE986566] SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys ZwTerminateThread [0xEE986334] ---- Kernel code sections - GMER 2.1 ---- .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF30153C0, 0x84E14A, 0xE8000020] ---- User code sections - GMER 2.1 ---- .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[260] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[260] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[260] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[260] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[260] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wdfmgr.exe[392] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\wdfmgr.exe[392] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wdfmgr.exe[392] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\wdfmgr.exe[392] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\wdfmgr.exe[392] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\csrss.exe[728] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 5 Bytes JMP 100015D0 C:\WINDOWS\system32\cmdcsr.dll .text C:\WINDOWS\system32\csrss.exe[728] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 5 Bytes JMP 10001A50 C:\WINDOWS\system32\cmdcsr.dll .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[800] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\services.exe[800] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\services.exe[800] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\services.exe[800] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\services.exe[800] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A .text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\services.exe[800] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\services.exe[800] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\services.exe[800] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\services.exe[800] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\services.exe[800] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [72, 71] {JB 0x73} .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [6F, 71] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[812] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A2, 71] .text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AA0001 .text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719A000A .text C:\WINDOWS\system32\lsass.exe[812] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7197000A .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718E000A .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7194000A .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\lsass.exe[812] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [90, 71] .text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 7179000A .text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717C000A .text C:\WINDOWS\system32\lsass.exe[812] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7176000A .text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 717F000A .text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7182000A .text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7188000A .text C:\WINDOWS\system32\lsass.exe[812] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7185000A .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[972] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[972] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[972] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[972] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A .text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[972] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[972] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [6F, 71] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [6C, 71] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\alg.exe[1000] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A3, 71] .text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 7197000A .text C:\WINDOWS\System32\alg.exe[1000] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7194000A .text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 7176000A .text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7179000A .text C:\WINDOWS\System32\alg.exe[1000] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7173000A .text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 717C000A .text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 717F000A .text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7185000A .text C:\WINDOWS\System32\alg.exe[1000] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7182000A .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718B000A .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7191000A .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\alg.exe[1000] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [8D, 71] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1048] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[1048] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1048] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[1048] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A .text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[1048] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[1048] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\svchost.exe[1048] rpcss.dll!WhichService 76A63C84 8 Bytes [20, 30, 01, 10, E0, 2D, 01, ...] {AND [EAX], DH; ADD [EAX], EDX; LOOPNZ 0x33; ADD [EAX], EDX} .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1144] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 00401E70 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe .text C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe[1144] ntdll.dll!NtCreateFile 7C90D090 5 Bytes JMP 004453F0 C:\Program Files\COMODO\COMODO Internet Security\cmdagent.exe .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1176] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[1176] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1176] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[1176] RPCRT4.dll!RpcServerRegisterIfEx 77E8E05B 6 Bytes JMP 7190000A .text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[1176] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[1176] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1328] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[1328] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1328] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[1328] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[1328] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe[1436] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 00401200 C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe .text C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe[1436] ntdll.dll!NtCreateFile 7C90D090 5 Bytes JMP 00401000 C:\Program Files\COMODO\COMODO Internet Security\cavwp.exe .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1484] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\svchost.exe[1484] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\svchost.exe[1484] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\spoolsv.exe[1644] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\spoolsv.exe[1644] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\spoolsv.exe[1644] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\spoolsv.exe[1644] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\spoolsv.exe[1644] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\ABBYY\FineReader\11.00\Licensing\CE\NetworkLicenseServer.exe[1776] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Program Files\Application Updater\ApplicationUpdater.exe[1796] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [74, 71] {JZ 0x73} .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [71, 71] {JNO 0x73} .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719C000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7199000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7190000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7196000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [92, 71] .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7181000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7184000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718A000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7187000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717B000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717E000A .text C:\Program Files\Java\jre7\bin\jqs.exe[1912] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7178000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\nvsvc32.exe[1948] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\nvsvc32.exe[1948] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\wbem\wmiapsrv.exe[1984] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [73, 71] {JAE 0x73} .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [70, 71] {JO 0x73} .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A3, 71] .text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719B000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 7198000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 718F000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7195000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\HPZipm12.exe[2036] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [91, 71] .text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717A000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 717D000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 7177000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7180000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7183000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 7189000A .text C:\WINDOWS\system32\HPZipm12.exe[2036] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 7186000A .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[2600] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\wscntfy.exe[2600] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\wscntfy.exe[2600] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\wscntfy.exe[2600] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\wscntfy.exe[2600] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\Explorer.EXE[2644] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\Explorer.EXE[2644] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\Explorer.EXE[2644] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\Explorer.EXE[2644] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\Explorer.EXE[2644] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\RunDLL32.exe[2816] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe[2928] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Program Files\Opera\opera.exe[3032] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\Program Files\Opera\opera.exe[3032] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Program Files\Opera\opera.exe[3032] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\Program Files\Opera\opera.exe[3032] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\Program Files\Opera\opera.exe[3032] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[3040] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\system32\ctfmon.exe[3040] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\system32\ctfmon.exe[3040] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\system32\ctfmon.exe[3040] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\system32\ctfmon.exe[3040] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[3284] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\WINDOWS\System32\svchost.exe[3284] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\WINDOWS\System32\svchost.exe[3284] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] .text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\WINDOWS\System32\svchost.exe[3284] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\WINDOWS\System32\svchost.exe[3284] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Program Files\COMODO\COMODO Internet Security\cis.exe[3452] ntdll.dll!NtAllocateVirtualMemory 7C90CF50 5 Bytes JMP 0040AA50 C:\Program Files\COMODO\COMODO Internet Security\cis.exe .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtClose 7C90CFD0 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtClose + 4 7C90CFD4 2 Bytes [AE, 71] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePort 7C90DA70 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePort + 4 7C90DA74 2 Bytes [77, 71] {JA 0x73} .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePortEx 7C90DA80 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!NtReplyWaitReceivePortEx + 4 7C90DA84 2 Bytes [74, 71] {JZ 0x73} .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!LdrUnloadDll 7C91736B 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ntdll.dll!LdrUnloadDll + 4 7C91736F 2 Bytes [A7, 71] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!LoadLibraryExW + C4 7C801BB9 4 Bytes CALL 71AC0001 .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!CreateProcessW 7C802336 6 Bytes JMP 719F000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] kernel32.dll!CreateProcessA 7C80236B 6 Bytes JMP 719C000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWindowsHookExW 7E37820F 6 Bytes JMP 717E000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWindowsHookExA 7E381211 6 Bytes JMP 7181000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] USER32.dll!SetWinEventHook 7E3817F7 6 Bytes JMP 717B000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!DeleteDC 77F16E5F 6 Bytes JMP 7184000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!GetPixel 77F1B73C 6 Bytes JMP 7187000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!CreateDCA 77F1B7C2 6 Bytes JMP 718D000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] GDI32.dll!CreateDCW 77F1BE28 6 Bytes JMP 718A000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!LsaClose + 508 77DD23EC 4 Bytes [C0, 46, 01, 10] {ROL BYTE [ESI+0x1], 0x10} .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!LsaClose + 510 77DD23F4 4 Bytes [50, 47, 01, 10] {PUSH EAX; INC EDI; ADD [EAX], EDX} .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessAsUserW 77DDA889 6 Bytes JMP 7193000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessAsUserA 77E00C80 6 Bytes JMP 7199000A .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessWithLogonW 77E05FD5 3 Bytes [FF, 25, 1E] .text C:\Documents and Settings\Komputer\Pulpit\gmer\gmer.exe[4092] ADVAPI32.dll!CreateProcessWithLogonW + 4 77E05FD9 2 Bytes [95, 71] ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\Tcpip \Device\Ip cmdhlp.sys AttachedDevice \Driver\Tcpip \Device\Tcp cmdhlp.sys AttachedDevice \Driver\Tcpip \Device\Udp cmdhlp.sys AttachedDevice \Driver\Tcpip \Device\RawIp cmdhlp.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Video\{CF8E2FC3-DB4F-4676-8121-BB5165B88BE6}\0000@D3D_\x3332\x3331 2089309684 Reg HKLM\SYSTEM\ControlSet003\Control\Video\{CF8E2FC3-DB4F-4676-8121-BB5165B88BE6}\0000@D3D_\x3332\x3331 2089309684 ---- EOF - GMER 2.1 ---- [/log]
Natsuki Kuga komentarz 5 września 2013 komentarz 5 września 2013 1. Do OTL w okno Własne opcje skanowania/Skrypt wklej: :OTL IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.goo...ts.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL IE - HKU\S-1-5-21-1229272821-1770027372-725345543-1003\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = http://websearch.goo...ts.info/?l=1&q={searchTerms}&pid=34&r=2013/02/03&hid=89810306&lg=EN&cc=PL O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.) O4 - HKU\S-1-5-21-1229272821-1770027372-725345543-1003..\Run: [ASRSetup] F:\ASRSetup.exe File not found O20 - AppInit_DLLs: (c:\progra~1\browse~1\sprote~1.dll) - File not found :Files C:\Program Files\Common Files\Spigot\Search Settings C:\Documents and Settings\Komputer\Dane aplikacji\Search Settings Kliknij Wykonaj skrypt, pokaż raport.2. Użyj AdwCleaner z opcji Usuń. Pokaż raport.3. Pokaż zestaw nowych logów z OTL.
Wciąż szukasz rozwiązania problemu? Napisz teraz na forum!
Możesz zadać pytanie bez konieczności rejestracji - wystarczy, że wypełnisz formularz.