GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2011-12-09 01:29:30 Windows 5.1.2600 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2040AH rev.00400097 Running: mhc1psqd.exe; Driver: C:\DOCUME~1\qbar\LOCALS~1\Temp\pwxdraoc.sys ---- System - GMER 1.0.15 ---- SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwConnectPort [0xB19092F4] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateFile [0xB19035CA] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateKey [0xB192258A] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreatePort [0xB1909A80] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwCreateWaitablePort [0xB1909BB6] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteFile [0xB19041E0] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteKey [0xB1923E3C] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwDeleteValueKey [0xB19237B2] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey [0xB1924794] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwLoadKey2 [0xB192499C] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwOpenFile [0xB1903DF2] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRenameKey [0xB192572A] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwReplaceKey [0xB1925060] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRequestWaitReplyPort [0xB1908EC4] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwRestoreKey [0xB19260FC] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetInformationFile [0xB19045A4] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetSecurityObject [0xB1925C6A] SSDT \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ZwSetValueKey [0xB1922F72] ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\Explorer.EXE[288] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[308] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\winlogon.exe[504] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\services.exe[548] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\lsass.exe[560] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\Ati2evxx.exe[716] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[728] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[808] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\svchost.exe[848] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] kernel32.dll!SetUnhandledExceptionFilter 7C810386 5 Bytes JMP 209F37DD C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWDMP.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] USER32.dll!ChangeClipboardChain + 14 77D6F4A6 5 Bytes JMP 20CB9270 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wbem\wmiprvse.exe[888] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\dla\tfswctrl.exe[892] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[900] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[996] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\ctfmon.exe[1116] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] USER32.dll!ChangeClipboardChain + 14 77D6F4A6 5 Bytes JMP 20CB9270 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\spoolsv.exe[1344] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\acs.exe[1396] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wscntfy.exe[1480] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Program Files\Java\jre6\bin\jqs.exe[1504] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\svchost.exe[1568] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wdfmgr.exe[1628] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\System32\alg.exe[1924] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] ntdll.dll!NtAccessCheckByType 7C90D3B8 5 Bytes JMP 20CB8791 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] ntdll.dll!NtImpersonateClientOfPort 7C90DADB 5 Bytes JMP 20CB8D58 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] ntdll.dll!NtSetInformationProcess 7C90E62D 5 Bytes JMP 20CB89AB C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] kernel32.dll!OpenProcess 7C81E079 5 Bytes JMP 20CB846C C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] USER32.dll!FindWindowW 77D6F245 5 Bytes JMP 20CB825A C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] USER32.dll!FindWindowA 77D6F3C6 5 Bytes JMP 20CB828F C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] ADVAPI32.dll!ImpersonateNamedPipeClient 77DD7C97 5 Bytes JMP 20CB8E5D C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) .text C:\WINDOWS\system32\wuauclt.exe[3020] ADVAPI32.dll!SetThreadToken 77DD7E3D 5 Bytes JMP 20CB9036 C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisDeregisterProtocol] [B190C9A6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisDeregisterProtocol] [B190C9A6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisDeregisterProtocol] [B190C9A6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisDeregisterProtocol] [B190C9A6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\System32\drivers\afd.sys[ntoskrnl.exe!IoCreateFile] [B18EBF1A] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] [B190E3F6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisDeregisterProtocol] [B190C9A6] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] [B190EA3E] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [B190E24C] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtOpenFile] [B1905264] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtSetInformationFile] [B19050F2] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!IoCreateFile] [B1905454] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) IAT \SystemRoot\system32\DRIVERS\srv.sys[ntoskrnl.exe!NtCreateFile] [B1904B88] \SystemRoot\System32\vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\WINDOWS\Explorer.EXE[288] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\Ati2evxx.exe[308] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\winlogon.exe[504] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\services.exe[548] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\lsass.exe[560] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\Ati2evxx.exe[716] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\svchost.exe[728] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\svchost.exe[808] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\System32\svchost.exe[848] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\CheckPoint\ZAForceField\ForceField.exe[872] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\wbem\wmiprvse.exe[888] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\dla\tfswctrl.exe[892] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[896] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\svchost.exe[900] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[964] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\svchost.exe[996] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Toshiba\Windows Utilities\Hotkey.exe[1028] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe[1108] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\ctfmon.exe[1116] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [10003E90] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress] [10004380] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\msvcrt.dll [KERNEL32.dll!GetModuleHandleA] [10004340] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\ADVAPI32.dll [KERNEL32.dll!CreateThread] [10009EF0] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\RPCRT4.dll [KERNEL32.dll!CreateThread] [10009EF0] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [100020F0] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\Program Files\CheckPoint\ZAForceField\IswSvc.exe[1296] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!CreateThread] [10009EF0] C:\Program Files\CheckPoint\ZoneAlarm\vsinit.dll (TrueVector Service/Check Point Software Technologies LTD) IAT C:\WINDOWS\system32\spoolsv.exe[1344] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\acs.exe[1396] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[1472] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\wscntfy.exe[1480] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Program Files\Java\jre6\bin\jqs.exe[1504] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\svchost.exe[1568] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\wdfmgr.exe[1628] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\System32\alg.exe[1924] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\Documents and Settings\qbar\Desktop\mhc1psqd.exe[2992] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) IAT C:\WINDOWS\system32\wuauclt.exe[3020] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [20CB835C] C:\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll (ZoneAlarm Browser Security/Check Point Software Technologies) ---- Devices - GMER 1.0.15 ---- Device \Driver\Tcpip \Device\Ip vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\Tcpip \Device\Tcp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) Device \Driver\Tcpip \Device\Udp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) Device \Driver\Tcpip \Device\RawIp vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) Device \Driver\Tcpip \Device\IPMULTICAST vsdatant.sys (ZoneAlarm Firewalling Driver/Check Point Software Technologies LTD) Device \FileSystem\Cdfs \Cdfs tfsnifs.sys (Drive Letter Access Component/Sonic Solutions) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0xE8 0x34 0x2A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x53 0xE8 0x34 0x2A ... ---- EOF - GMER 1.0.15 ----