GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-07-19 17:15:07 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545032B9A300 rev.PB3OC60F 298,09GB Running: gmer.exe; Driver: C:\Users\Scorpius\AppData\Local\Temp\aftcqaob.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0x88794FC4] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0x9115E510] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0x88797456] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0x887974AE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0x887975C4] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0x887973AC] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0x887974FE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0x88797400] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0x88797572] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0x88794FE8] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0x9115E5C0] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0x88794DB2] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0x8879500C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0x887979BC] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0x88795AA4] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0x88797486] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0x887974D6] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0x887975EE] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0x887973D8] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0x8879753E] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0x8879742E] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0x8879759C] SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0x9115E658] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0x8879596A] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0x88795030] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0x88795054] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0x88794E0C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0x88794F48] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0x88794F24] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0x88794F6C] SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0x88795078] ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82E3D9F5 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E771F2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text ntkrnlpa.exe!KeRemoveQueueEx + 10CB 82E7E410 4 Bytes [C4, 4F, 79, 88] .text ntkrnlpa.exe!KeRemoveQueueEx + 10F3 82E7E438 4 Bytes [10, E5, 15, 91] .text ntkrnlpa.exe!KeRemoveQueueEx + 11A7 82E7E4EC 8 Bytes [56, 74, 79, 88, AE, 74, 79, ...] .text ntkrnlpa.exe!KeRemoveQueueEx + 11B3 82E7E4F8 4 Bytes [C4, 75, 79, 88] .text ntkrnlpa.exe!KeRemoveQueueEx + 11CF 82E7E514 4 Bytes [AC, 73, 79, 88] .text ... .sptd1 C:\Windows\System32\Drivers\sptd.sys entry point in ".sptd1" section [0x885BFB2E] .xreloc C:\Windows\system32\drivers\ps7arj8b.sys unknown last section [0x88226000, 0x9F4, 0x40000040] .text USBPORT.SYS!DllUnload 91FD0DB9 5 Bytes JMP 860171C8 .text admp561f.SYS!A0DB34FC6FE35D429A28ADDE5467D4D7 92939CA0 48 Bytes [9C, A8, E7, F0, B6, 37, ED, ...] ? C:\Windows\System32\Drivers\admp561f.SYS suspicious PE modification .text ayj1qht4.SYS!A0DB34FC6FE35D429A28ADDE5467D4D7 9299F2B0 48 Bytes [FB, 3A, 2A, 43, 68, 18, 5D, ...] ? C:\Windows\System32\Drivers\ayj1qht4.SYS suspicious PE modification .text ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes [E9, 89, 3B, 8E, 88] {JMP 0x888e3b8e} .text ntdll.dll!LdrLoadDll 7788223E 5 Bytes [E9, B5, DF, 8D, 88] {JMP 0x888ddfba} ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\taskhost.exe[404] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000503FC .text C:\Windows\system32\taskhost.exe[404] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000501F8 .text C:\Windows\system32\taskhost.exe[404] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\taskhost.exe[404] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000E0A08 .text C:\Windows\system32\taskhost.exe[404] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000E03FC .text C:\Windows\system32\taskhost.exe[404] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000E0804 .text C:\Windows\system32\taskhost.exe[404] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000E01F8 .text C:\Windows\system32\taskhost.exe[404] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000E0600 .text C:\Windows\system32\csrss.exe[444] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001703FC .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001701F8 .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00300A08 .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 003003FC .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00300804 .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 003001F8 .text C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe[452] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00300600 .text C:\Windows\system32\wininit.exe[496] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000303FC .text C:\Windows\system32\wininit.exe[496] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000301F8 .text C:\Windows\system32\wininit.exe[496] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\wininit.exe[496] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00050A08 .text C:\Windows\system32\wininit.exe[496] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000503FC .text C:\Windows\system32\wininit.exe[496] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00050804 .text C:\Windows\system32\wininit.exe[496] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000501F8 .text C:\Windows\system32\wininit.exe[496] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00050600 .text C:\Windows\system32\csrss.exe[504] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\services.exe[556] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\services.exe[556] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\services.exe[556] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\lsass.exe[564] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\lsass.exe[564] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\lsass.exe[564] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\lsass.exe[564] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00250A08 .text C:\Windows\system32\lsass.exe[564] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002503FC .text C:\Windows\system32\lsass.exe[564] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00250804 .text C:\Windows\system32\lsass.exe[564] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002501F8 .text C:\Windows\system32\lsass.exe[564] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00250600 .text C:\Windows\system32\lsm.exe[576] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\lsm.exe[576] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\lsm.exe[576] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\winlogon.exe[660] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000303FC .text C:\Windows\system32\winlogon.exe[660] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000301F8 .text C:\Windows\system32\winlogon.exe[660] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\winlogon.exe[660] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000C0A08 .text C:\Windows\system32\winlogon.exe[660] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000C03FC .text C:\Windows\system32\winlogon.exe[660] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000C0804 .text C:\Windows\system32\winlogon.exe[660] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000C01F8 .text C:\Windows\system32\winlogon.exe[660] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000C0600 .text C:\Windows\system32\svchost.exe[724] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[724] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[724] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[816] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[816] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[816] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\svchost.exe[912] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\System32\svchost.exe[912] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\System32\svchost.exe[912] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\svchost.exe[912] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00170A08 .text C:\Windows\System32\svchost.exe[912] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001703FC .text C:\Windows\System32\svchost.exe[912] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00170804 .text C:\Windows\System32\svchost.exe[912] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001701F8 .text C:\Windows\System32\svchost.exe[912] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00170600 .text C:\Windows\System32\svchost.exe[956] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\System32\svchost.exe[956] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\System32\svchost.exe[956] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\svchost.exe[956] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 008D0A08 .text C:\Windows\System32\svchost.exe[956] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 008D03FC .text C:\Windows\System32\svchost.exe[956] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 008D0804 .text C:\Windows\System32\svchost.exe[956] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 008D01F8 .text C:\Windows\System32\svchost.exe[956] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 008D0600 .text C:\Windows\system32\svchost.exe[996] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[996] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[996] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[996] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00490A08 .text C:\Windows\system32\svchost.exe[996] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 004903FC .text C:\Windows\system32\svchost.exe[996] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00490804 .text C:\Windows\system32\svchost.exe[996] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 004901F8 .text C:\Windows\system32\svchost.exe[996] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00490600 .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[1036] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[1036] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[1036] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00F20A08 .text C:\Windows\system32\svchost.exe[1036] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 00F203FC .text C:\Windows\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00F20804 .text C:\Windows\system32\svchost.exe[1036] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 00F201F8 .text C:\Windows\system32\svchost.exe[1036] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00F20600 .text C:\Windows\system32\svchost.exe[1300] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[1300] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[1300] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[1300] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00FA0A08 .text C:\Windows\system32\svchost.exe[1300] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 00FA03FC .text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00FA0804 .text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 00FA01F8 .text C:\Windows\system32\svchost.exe[1300] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00FA0600 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00180A08 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001803FC .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00180804 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001801F8 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1352] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00180600 .text C:\Program Files\RocketDock\RocketDock.exe[1388] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Program Files\RocketDock\RocketDock.exe[1388] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Program Files\RocketDock\RocketDock.exe[1388] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\RocketDock\RocketDock.exe[1388] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001F0A08 .text C:\Program Files\RocketDock\RocketDock.exe[1388] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001F03FC .text C:\Program Files\RocketDock\RocketDock.exe[1388] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001F0804 .text C:\Program Files\RocketDock\RocketDock.exe[1388] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001F01F8 .text C:\Program Files\RocketDock\RocketDock.exe[1388] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001F0600 .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1468] kernel32.dll!SetUnhandledExceptionFilter 7748F4FB 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP } .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1468] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\WLANExt.exe[1476] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\WLANExt.exe[1476] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\WLANExt.exe[1476] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\WLANExt.exe[1476] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00110A08 .text C:\Windows\system32\WLANExt.exe[1476] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001103FC .text C:\Windows\system32\WLANExt.exe[1476] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00110804 .text C:\Windows\system32\WLANExt.exe[1476] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001101F8 .text C:\Windows\system32\WLANExt.exe[1476] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00110600 .text C:\Windows\system32\conhost.exe[1484] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000303FC .text C:\Windows\system32\conhost.exe[1484] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000301F8 .text C:\Windows\system32\conhost.exe[1484] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\conhost.exe[1484] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000C0A08 .text C:\Windows\system32\conhost.exe[1484] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000C03FC .text C:\Windows\system32\conhost.exe[1484] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000C0804 .text C:\Windows\system32\conhost.exe[1484] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000C01F8 .text C:\Windows\system32\conhost.exe[1484] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000C0600 .text C:\Windows\system32\wuauclt.exe[1568] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000703FC .text C:\Windows\system32\wuauclt.exe[1568] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000701F8 .text C:\Windows\system32\wuauclt.exe[1568] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\wuauclt.exe[1568] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00090A08 .text C:\Windows\system32\wuauclt.exe[1568] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000903FC .text C:\Windows\system32\wuauclt.exe[1568] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00090804 .text C:\Windows\system32\wuauclt.exe[1568] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000901F8 .text C:\Windows\system32\wuauclt.exe[1568] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00090600 .text C:\Windows\system32\SearchIndexer.exe[1576] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\SearchIndexer.exe[1576] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\SearchIndexer.exe[1576] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\SearchIndexer.exe[1576] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000D0A08 .text C:\Windows\system32\SearchIndexer.exe[1576] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000D03FC .text C:\Windows\system32\SearchIndexer.exe[1576] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000D0804 .text C:\Windows\system32\SearchIndexer.exe[1576] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000D01F8 .text C:\Windows\system32\SearchIndexer.exe[1576] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000D0600 .text C:\Windows\system32\Dwm.exe[1756] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\Dwm.exe[1756] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\Dwm.exe[1756] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\Dwm.exe[1756] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000F0A08 .text C:\Windows\system32\Dwm.exe[1756] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000F03FC .text C:\Windows\system32\Dwm.exe[1756] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000F0804 .text C:\Windows\system32\Dwm.exe[1756] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000F01F8 .text C:\Windows\system32\Dwm.exe[1756] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000F0600 .text C:\Windows\Explorer.EXE[1880] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000A03FC .text C:\Windows\Explorer.EXE[1880] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000A01F8 .text C:\Windows\Explorer.EXE[1880] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\Explorer.EXE[1880] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00150A08 .text C:\Windows\Explorer.EXE[1880] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001503FC .text C:\Windows\Explorer.EXE[1880] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00150804 .text C:\Windows\Explorer.EXE[1880] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001501F8 .text C:\Windows\Explorer.EXE[1880] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00150600 .text C:\Windows\System32\spoolsv.exe[1960] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\System32\spoolsv.exe[1960] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\System32\spoolsv.exe[1960] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\spoolsv.exe[1960] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00150A08 .text C:\Windows\System32\spoolsv.exe[1960] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001503FC .text C:\Windows\System32\spoolsv.exe[1960] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00150804 .text C:\Windows\System32\spoolsv.exe[1960] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001501F8 .text C:\Windows\System32\spoolsv.exe[1960] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00150600 .text C:\Windows\system32\svchost.exe[1988] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[1988] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[1988] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[1988] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00140A08 .text C:\Windows\system32\svchost.exe[1988] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001403FC .text C:\Windows\system32\svchost.exe[1988] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00140804 .text C:\Windows\system32\svchost.exe[1988] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001401F8 .text C:\Windows\system32\svchost.exe[1988] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00140600 .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001F0A08 .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001F03FC .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001F0804 .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001F01F8 .text C:\Program Files\LogMeIn Hamachi\hamachi-2.exe[2152] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001F0600 .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00240A08 .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002403FC .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00240804 .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002401F8 .text C:\Program Files\McAfee Security Scan\3.0.318\SSScheduler.exe[2180] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00240600 .text C:\Windows\system32\PnkBstrA.exe[2220] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001503FC .text C:\Windows\system32\PnkBstrA.exe[2220] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001501F8 .text C:\Windows\system32\PnkBstrA.exe[2220] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\PnkBstrA.exe[2220] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001E0A08 .text C:\Windows\system32\PnkBstrA.exe[2220] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001E03FC .text C:\Windows\system32\PnkBstrA.exe[2220] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001E0804 .text C:\Windows\system32\PnkBstrA.exe[2220] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001E01F8 .text C:\Windows\system32\PnkBstrA.exe[2220] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001E0600 .text C:\Windows\system32\PnkBstrB.exe[2264] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001503FC .text C:\Windows\system32\PnkBstrB.exe[2264] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001501F8 .text C:\Windows\system32\PnkBstrB.exe[2264] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\PnkBstrB.exe[2264] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001E0A08 .text C:\Windows\system32\PnkBstrB.exe[2264] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001E03FC .text C:\Windows\system32\PnkBstrB.exe[2264] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001E0804 .text C:\Windows\system32\PnkBstrB.exe[2264] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001E01F8 .text C:\Windows\system32\PnkBstrB.exe[2264] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001E0600 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000503FC .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000501F8 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000F0A08 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000F03FC .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000F0804 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000F01F8 .text C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe[2384] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000F0600 .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000503FC .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000501F8 .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000F0A08 .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000F03FC .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000F0804 .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000F01F8 .text C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe[2512] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000F0600 .text C:\Windows\system32\svchost.exe[2532] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[2532] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[2532] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[2872] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\system32\svchost.exe[2872] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\system32\svchost.exe[2872] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\svchost.exe[2872] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00450A08 .text C:\Windows\system32\svchost.exe[2872] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 004503FC .text C:\Windows\system32\svchost.exe[2872] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00450804 .text C:\Windows\system32\svchost.exe[2872] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 004501F8 .text C:\Windows\system32\svchost.exe[2872] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00450600 .text C:\Windows\system32\taskhost.exe[3012] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000503FC .text C:\Windows\system32\taskhost.exe[3012] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000501F8 .text C:\Windows\system32\taskhost.exe[3012] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\taskhost.exe[3012] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 000E0A08 .text C:\Windows\system32\taskhost.exe[3012] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 000E03FC .text C:\Windows\system32\taskhost.exe[3012] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 000E0804 .text C:\Windows\system32\taskhost.exe[3012] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 000E01F8 .text C:\Windows\system32\taskhost.exe[3012] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 000E0600 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00240A08 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002403FC .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00240804 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002401F8 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3156] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00240600 .text C:\Windows\System32\rundll32.exe[3220] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000703FC .text C:\Windows\System32\rundll32.exe[3220] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000701F8 .text C:\Windows\System32\rundll32.exe[3220] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\rundll32.exe[3220] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00110A08 .text C:\Windows\System32\rundll32.exe[3220] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001103FC .text C:\Windows\System32\rundll32.exe[3220] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00110804 .text C:\Windows\System32\rundll32.exe[3220] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001101F8 .text C:\Windows\System32\rundll32.exe[3220] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00110600 .text C:\Windows\System32\svchost.exe[3336] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Windows\System32\svchost.exe[3336] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Windows\System32\svchost.exe[3336] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\svchost.exe[3336] user32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00460A08 .text C:\Windows\System32\svchost.exe[3336] user32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 004603FC .text C:\Windows\System32\svchost.exe[3336] user32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00460804 .text C:\Windows\System32\svchost.exe[3336] user32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 004601F8 .text C:\Windows\System32\svchost.exe[3336] user32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00460600 .text C:\Windows\System32\igfxtray.exe[3620] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Windows\System32\igfxtray.exe[3620] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Windows\System32\igfxtray.exe[3620] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\igfxtray.exe[3620] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00300A08 .text C:\Windows\System32\igfxtray.exe[3620] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 003003FC .text C:\Windows\System32\igfxtray.exe[3620] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00300804 .text C:\Windows\System32\igfxtray.exe[3620] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 003001F8 .text C:\Windows\System32\igfxtray.exe[3620] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00300600 .text C:\Windows\System32\hkcmd.exe[3660] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Windows\System32\hkcmd.exe[3660] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Windows\System32\hkcmd.exe[3660] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\hkcmd.exe[3660] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00200A08 .text C:\Windows\System32\hkcmd.exe[3660] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002003FC .text C:\Windows\System32\hkcmd.exe[3660] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00200804 .text C:\Windows\System32\hkcmd.exe[3660] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002001F8 .text C:\Windows\System32\hkcmd.exe[3660] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00200600 .text C:\Windows\system32\igfxsrvc.exe[3724] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Windows\system32\igfxsrvc.exe[3724] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Windows\system32\igfxsrvc.exe[3724] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\system32\igfxsrvc.exe[3724] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001F0A08 .text C:\Windows\system32\igfxsrvc.exe[3724] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001F03FC .text C:\Windows\system32\igfxsrvc.exe[3724] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001F0804 .text C:\Windows\system32\igfxsrvc.exe[3724] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001F01F8 .text C:\Windows\system32\igfxsrvc.exe[3724] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001F0600 .text C:\Windows\System32\igfxpers.exe[3780] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Windows\System32\igfxpers.exe[3780] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Windows\System32\igfxpers.exe[3780] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\igfxpers.exe[3780] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00200A08 .text C:\Windows\System32\igfxpers.exe[3780] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002003FC .text C:\Windows\System32\igfxpers.exe[3780] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00200804 .text C:\Windows\System32\igfxpers.exe[3780] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002001F8 .text C:\Windows\System32\igfxpers.exe[3780] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00200600 .text C:\Windows\System32\svchost.exe[3788] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000A03FC .text C:\Windows\System32\svchost.exe[3788] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000A01F8 .text C:\Windows\System32\svchost.exe[3788] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Windows\System32\svchost.exe[3788] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00180A08 .text C:\Windows\System32\svchost.exe[3788] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001803FC .text C:\Windows\System32\svchost.exe[3788] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00180804 .text C:\Windows\System32\svchost.exe[3788] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001801F8 .text C:\Windows\System32\svchost.exe[3788] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00180600 .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[3820] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 000603FC .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 000601F8 .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 00200A08 .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002003FC .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 00200804 .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002001F8 .text C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3828] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 00200600 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001703FC .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001701F8 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 001A0A08 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 001A03FC .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 001A0804 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 001A01F8 .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[3896] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 001A0600 .text C:\Windows\system32\AUDIODG.EXE[3920] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 003F0A08 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 003F03FC .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 003F0804 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 003F01F8 .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ArcCon.ac[4072] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 003F0600 .text C:\Users\Scorpius\Desktop\gmer.exe[5152] ntdll.dll!LdrUnloadDll 7787C86E 5 Bytes JMP 001603FC .text C:\Users\Scorpius\Desktop\gmer.exe[5152] ntdll.dll!LdrLoadDll 7788223E 5 Bytes JMP 001601F8 .text C:\Users\Scorpius\Desktop\gmer.exe[5152] kernel32.dll!GetBinaryTypeW + 70 774A69F4 1 Byte [62] .text C:\Users\Scorpius\Desktop\gmer.exe[5152] USER32.dll!UnhookWindowsHookEx 75C2ADF9 5 Bytes JMP 002F0A08 .text C:\Users\Scorpius\Desktop\gmer.exe[5152] USER32.dll!UnhookWinEvent 75C2B750 5 Bytes JMP 002F03FC .text C:\Users\Scorpius\Desktop\gmer.exe[5152] USER32.dll!SetWindowsHookExW 75C2E30C 5 Bytes JMP 002F0804 .text C:\Users\Scorpius\Desktop\gmer.exe[5152] USER32.dll!SetWinEventHook 75C324DC 5 Bytes JMP 002F01F8 .text C:\Users\Scorpius\Desktop\gmer.exe[5152] USER32.dll!SetWindowsHookExA 75C56D0C 5 Bytes JMP 002F0600 ---- Kernel IAT/EAT - GMER 2.1 ---- IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [884CA730] \SystemRoot\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [884CAF12] \SystemRoot\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUlong] [884CB232] \SystemRoot\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [884CB0F0] \SystemRoot\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [884CA914] \SystemRoot\System32\Drivers\sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\System32\rundll32.exe[3220] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7575FFF6] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Windows\System32\rundll32.exe[3220] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [7575FFF6] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Windows\System32\rundll32.exe[3220] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [7575FFF6] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Windows\System32\rundll32.exe[3220] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [7575FFF6] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) ---- Devices - GMER 2.1 ---- Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software) Device \FileSystem\Ntfs \Ntfs 8594E1E8 Device \FileSystem\fastfat \FatCdrom 859EC1E8 Device \Driver\usbehci \Device\USBPDO-0 85FF01E8 Device \Driver\usbehci \Device\USBPDO-1 85FF01E8 AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) Device \Driver\cdrom \Device\CdRom0 85DE41E8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 8594A1E8 Device \Driver\atapi \Device\Ide\IdePort0 8594A1E8 Device \Driver\atapi \Device\Ide\IdePort1 8594A1E8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 8594A1E8 Device \Driver\msahci \Device\Ide\PciIde0Channel0 8594B1E8 Device \Driver\msahci \Device\Ide\PciIde0Channel1 8594B1E8 Device \Driver\cdrom \Device\CdRom1 85DE41E8 Device \Driver\cdrom \Device\CdRom2 85DE41E8 Device \Driver\cdrom \Device\CdRom3 85DE41E8 Device \Driver\NetBT \Device\NetBt_Wins_Export 85F041E8 AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software) Device \Driver\NetBT \Device\NetBT_Tcpip_{0CB5B886-B2BE-4B3C-926C-9F8B6ED9BBBA} 85F041E8 Device \Driver\PCI_PNP4500 \Device\0000006c sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) Device \Driver\PCI_PNP4500 \Device\0000006c sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) Device \Driver\usbehci \Device\USBFDO-0 85FF01E8 Device \Driver\PCI_PNP4500 \Device\0000006d sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) Device \Driver\PCI_PNP4500 \Device\0000006d sptd.sys (SCSI Pass Through Direct Host/Duplex Secure Ltd.) Device \Driver\usbehci \Device\USBFDO-1 85FF01E8 Device \Driver\NetBT \Device\NetBT_Tcpip_{C470241A-D70C-441F-9DE3-3BA8467AC033} 85F041E8 Device \Driver\NetBT \Device\NetBT_Tcpip_{8F05DB6C-E398-430E-9CF4-6FFAAD865DD6} 85F041E8 Device \Driver\NetBT \Device\NetBT_Tcpip_{9B85FA07-8EF3-42C9-849C-0F14608A97A3} 85F041E8 Device \Driver\ayj1qht4 \Device\Scsi\ayj1qht41Port3Path0Target0Lun0 85EDC1E8 Device \Driver\admp561f \Device\Scsi\admp561f1 860BB1E8 Device \Driver\ayj1qht4 \Device\Scsi\ayj1qht41 85EDC1E8 Device \Driver\admp561f \Device\Scsi\admp561f1Port2Path0Target0Lun0 860BB1E8 Device \FileSystem\fastfat \Fat 859EC1E8 AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Menedżer filtrów systemu plików firmy Microsoft/Microsoft Corporation) ---- Trace I/O - GMER 2.1 ---- Trace ntkrnlpa.exe CLASSPNP.SYS disk.sys >>UNKNOWN [0x8594a1e8]<< 8594a1e8 Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x85b9e030] 85b9e030 Trace 3 CLASSPNP.SYS[88bad59e] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x85a38908] 85a38908 Trace \Driver\atapi[0x85a222f0] -> IRP_MJ_CREATE -> 0x8594a1e8 8594a1e8 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x6E 0x73 0x2B 0xC9 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x5C 0x5B 0xEF 0x95 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFC 0x7A 0x00 0x1D ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD8 0x7E 0xD4 0x21 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x01 0x72 0x09 0x48 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6D 0x6A 0xE2 0x14 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x6E 0x73 0x2B 0xC9 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x5C 0x5B 0xEF 0x95 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xFC 0x7A 0x00 0x1D ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 1 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xD8 0x7E 0xD4 0x21 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x01 0x72 0x09 0x48 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x6D 0x6A 0xE2 0x14 ... ---- EOF - GMER 2.1 ----