Tech Support Guy Forums

Realtek wireless driver for Windows 2008 R2 enterprise server

freespirited17 — Fri, 24 May 2013 03:44:13 GMT

Hi All

I recently installed Windows server 2008 R2 enterprise on my personal laptop on a 40 GB drive.On the rest of disk space, I have Win 7 homepremiuim installed and has secure Wifi internet connectivity. Now, I am trying to connect the wifi on my server, but its just not showing anything. I downloaded driver Realtek RTL8191se Wireless LAN 802.11n in HomePremium and ran it on server disk partition. So, my device manager is showing up to date however its still not connecting the wifi and saying that there is a problem with wireless adapter. I am totally cluless...please help!!!

Can't connect to internet

Blocho — Fri, 24 May 2013 03:27:37 GMT

Hi,

My computer has recently become incapable of connecting to my home internet. My apartment building is wired, and I have an internet jack in my apartment. The jack in my apartment is connected to a netgear router. The building also has two routers for general use, linksys and netgear. Since I moved into the building in October, every few weeks I would lose my access to the internet. Usually I just reset the router and it was fine.

In the past three weeks, this has not worked. I often go several days at a time being unable to access the internet, whether I am using my own router or the two general ones in the building. Then it will work for a few hours before becoming unusable again. I have also tried plugging my computer directly into the internet jack, but I get the same result. Resetting the router multiple times does not improve the situation. I have been assured by the building manager that the system has had no problems and everyone else in the building can connect. When this problem occurs, my network and sharing system shows that my computer is connected to the router but that the router is not connected to the internet. I have also tried a system restore to a month ago, before this problem arose, but nothing changed.

I have an HP Pavilion dv4 Notebook PC, running Windows 7 home premium.

Any ideas? All help will be greatly appreciated.

Thanks.

need input/advice what kind of new laptop to get

bp936 — Fri, 24 May 2013 02:41:37 GMT

After putting my beloved 10 years old or so Toshiba on lifesupport 2 years ago, it shows signs of getting too hot again too often.
Now I don't know what to replace it with, I am so used to XP and I see so many problems with Windows 8, would I be better off trying to find a Windows7 laptop? Can"t afford a Mac and it is probably too hard to learn its OS.
I never play games, or download anything but use it for email and family pix organizing. I need 4 USB ports, because the new computers don't seem to have a modem, needed for dial-up to get some kind of device unfortunately.
Any advise what brand is reliable? Is there a laptop with matte screen still? Will I have to replace my old programs, like Word and Paintshop Pro?
I' ll appreciate any advise.

Attached Thumbnails

Sound devices not recognized

kalalaug — Fri, 24 May 2013 01:53:03 GMT

OK,

Last night my sound was fine. This morning I had to hardkill my computer. When it started again, my sound would not work. Mousing over the sound icon in the tray said no sound devices were plugged in, even though they are. When I go to the audio tab in control panel devices are there but are grayed out. I tried reinstalling realtek HD drivers. They seemed to install correctly, but still same problem. Checked BIOS and sound is enabled. Tried installing generic Windows drivers but that did not work either. When I try to open Realtek sound manager, I get an error that says dirver is Vista only. But driver download is for XP/7/8/Vista versions. When I look at the file on my drive, it looks there are folder for vista, but not Windows 7 (my OS).

If I go control panel I can see the audio devices, but they are grayed out. Have run reg scans and virus scans but still nothing.

MSE Number of Files Changing

Unlucky_Pete — Fri, 24 May 2013 01:28:28 GMT

Some time last year when I ran a full-system scan on Microsoft Security Essentials, the total number of files scanned was 375,752. I recorded this number, because I was curious about how many files MSE scans.

I don't usually pay much attention to this number, but yesterday when I completed a full-system scan the total came out as 344,937.

Since I haven't really deleted much I was curious about why the number had dropped like this. I figured that MSE must be skipping some files like NIS 2012 does after repeated scans, but when I restart the computer and run the full-system scan again, the total comes out different each time. I've even tried turning-off and then turning-on real-time protection to see if it would make a difference, but the numbers continue to fluctuate each time.

So far I've had the following results:

326,542
344,442
276,683
344,654

I'm probably worrying over nothing, but is this normal and what is the cause of this?

Thanks in advanced,

- Unlucky Pete

Windows 7, dtuser.exe, explorer closes

vernonproblems — Fri, 24 May 2013 01:15:16 GMT

Hello techs:

I have a bunch of problems so there is no ONE problem.
Explorer closes and maybe I can reopen a page or I have to close and reopen...this happens for regular online and even worse I can't send emails, they freeze and I can't continue them and I loose all my message. Can't copy and paste. Ticks me off when emailing with 4 paragraphs and it freezes before the save time and I could be 2 paragraphs behind. I have to constantly re-click to continue typing.

Tired of getting kicked out of my ONLINE games. When playing sometimes the game will stay up and I can play for hours, OR it flips to my desktop about every 30 seconds. I then have to stop and run all of scans and try again...

I have Speedy PC Pro, PC Tuneup Maestro, and Fix Cleaner. I can't run Spybot and my system will not allow me to download McAfee even though my boyfriend has a subscription for both machines.

I have a memory problem so I will do my best to give you the required information.
Windows 7, Dell XPS 8300, Service Pack 1, 64-bit operating system, DtUser error msg.

I have tried different sites, and most of them state..."Free download" yeah that part is FREE, but that's it!

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: Intel(R) Core(TM) i7-2600 CPU @ 3.40GHz, Intel64 Family 6 Model 42 Stepping 7
Processor Count: 8
RAM: 8174 Mb
Graphics Card: AMD Radeon HD 6700 Series, 1024 Mb
Hard Drives: C: Total - 1417191 MB, Free - 1267407 MB;
Motherboard: Dell Inc., 0Y2MRG
Antivirus: PC Cleaner Pro, Updated: Yes, On-Demand Scanner: Disabled

Thank you I hope to hear from someone with help.

Vernonproblems

Solved: How Best To Downgrade Internet Explorer

Pandimensional — Fri, 24 May 2013 01:13:07 GMT

Hello,

Whatever recent IE upgrade that took place has sidelined my dad so he called me for help. Because I do not use IE, I personally am not effected nor know what he's talking about. From what I can gather, there must have been an auto update to a new version of IE that took place on his computer recently.

He doesn't know how to use the new version as it apparently looks different. Plus, whatever he's doing in regard to his business requires the previous version, I guess some business app or website does not work right now.

How best to downgrade to the previous version? Is there a way to do this without loosing all his IE settings?

Thanks!

Hal.dll file missing and cannot boot to any CD (XP)

cuttlefish — Fri, 24 May 2013 01:12:50 GMT

For no apparent reason this error has occurred on my wife's PC and after Googling everywhere I have found that the most common solution is to simply insert the Installation CD into the PC and then respond to the "boot from any CD" prompt and after that I think I could fix it all OK...........

But I can't get the "boot from any PC prompt" up i.e appears the system is not finding the Windows disc and then reverts to the error message!

I have tried the F5, F8, pressing DEL or TAB during the reboot but no joy!

Help!!:(:o

Need help with cell phone outbox

bp936 — Fri, 24 May 2013 01:05:32 GMT

Now that I finally got a cell, it worked for 3 month, but then email outbox stopped working. I thought its the Samsung, but then I found out, many Android and many brands (per Google) have this problem.
Anyone ever found out how to fix this? I brought mine back to the store, the guy worked on it for 70 minutes and finally got it, didn't remember what he changed. It only worked for 3 days and lost its capabilities again to send emails from OUTBOX. I personally reset everything at least 20 times, nothing seems to work. Google does not give anyone for any brand an answer.
Tried K0 but that also seems to be blocked to send.

Is it better to get an Iphone or Blackberry? I just don't like the price, mine was kind of free with Koodo and I didn't have to sign up for 3 years.

Hope someone has a miracle answer, because the rest of Samsung Ace, I really like.

bogus software ?

sammi44 — Fri, 24 May 2013 01:02:15 GMT

I RECENTLY DOWNLOADED REGSERVO software AND FOOLISHLY PAID FOR IT IMMEDIATELY. THE COMPANY SENT ME A LICENCE KEY WHICH I INSERTED INTO THE PROPER SPACE PROVIDED.THE MESSAGE I RECEIVED WAS ----WRONG KEY NUMBER SEQUENCE---WHICH I TRIPLE CHECKED IT FOR ACCURACY AND IT WAS THE KEY THAT THEY HAD SENT ME. IS THIS COMPANY LEGIT ? ALL CORRESPONDENCE IS LIKE A BROKEN RECORD FROM THEIR END,TELLING ME TO FORWARD AN ID NUMER WHICH I DON,T HAVE !
ANYWAY, THANKS FOR LISTENING .

SAMMI44

CCTV dvr. Net Suveillance

carlospassow — Fri, 24 May 2013 00:56:52 GMT

Hey Guys;
I have a dilema and a problem that I am very frustrating trying to resolve.

Ive just bought a dvr 8 cameras.

I basically set up everything like this

Att router to bridge - apple router to dhcp ppoe log in to att.

then I add another apple router to expand the wireless as well connected to the cat5 to the cameras netwrok port so it stream back to main router.

Open the port 88 for the port forwarding and kaboom everything working flawlessly, port open you can log in in the cameras with the ip address and so far.

If i log on inside my network i can see the cameras fine.

Once I log on the outside network so I can view it from far away it opens the page open the square for each camera but it jsut thinks and i cannot see the picture( cameras image) it stays on quicktime loading screen for EVER.

I need help.

is my internet band enought ?
maybe because I am streaming it wirelessly not plugged fisicaly on the main router is not sending enought speed?

Well basically I had a 4 channel dvr and it worked flawlessly oNline and offline.

Si now I say what gives..... i change many times the setting for quif D1, dif.... still no luck.

Help will be awesome! thanks

Do I still use thermal paste on a cooling fan with insulating tape?

sh1ftelliott — Fri, 24 May 2013 00:50:46 GMT

I bought a Cooler Master 212 EVO and am ready to install it. I noticed that at the end it says "Don't peel off the insulating tape. The insulating tape must face the motherboard"

So my question is, do I still apple the pea sized amount of thermal paste on my CPU before I install the heatsink?

What does the insulating tape do?

Solved: A People's Computer

goedel — Fri, 24 May 2013 00:44:46 GMT

Why am I offered in the retail marketplace for personal computers only computers that require much larger hard-drives and RAM than I need? My need is after all determined by my activities and what available computer software can do for me. As far as I know, there are no new applications that would either extend my activities, or make them less difficult or more pleasurable than now. I can accomplish what I wish to do with my 38GB HD, 2GB RAM, and 256MB video RAM, using Windows XP. When my system fails, as sooner or later it will, I am faced with having to choose from desktops with 500GB HD and 6GB RAM and Windows 7 or 8. The latter OSs require a great deal of HD and RAM to run properly, I am told. With all the extra stuff, I shall still only wish to use email. word-process, surf the internet, use an internet phone service. I can do all that with XP and my limited system.

Since 2004, when my no-brand computer was assembled, the cost of a GB of HD or RAM has probably much diminished. The chipset in my system, its CPU, circuit boards, are probably cheaper to make than nine years ago. I should be able to buy a computer like the one I now have but brand new for less than $150. Why must I consider spending $500 for a computer without a monitor and only one year's manufacturer's warranty and very limited tech support?

I do not wish to store 50,000 photos or musical clips or videos from youtube. I just want to do the same old thing, because the software designers have not come up with anything new that I just have to have!

HDTV power supply board blown?

dacker — Fri, 24 May 2013 00:40:07 GMT

Yesterday my community had a five hour power failure which included a power surge strong enough to blow the electric meters off several houses and cause a few small fires.

My losses included failure of two identical two year-old Toshiba 32" HDTVs, model 32C100U2 (and a ceiling fan). Neither TV would start via the remote or the power button.

Surprisingly, this TV does not have a consumer-replaceable fuse so I opened-up the back of each and easily determined the fuse had blown in each. Unfortunately, replacing the fuses resulted in another pair of blown fuses. On one TV, I pulled the cables leading to the other boards and tried another fuse -- which immediately fried.

This leads me to believe the power supply board (PK101V1550I) is damaged. There are no obvious blown components on either board. The caps look intact.

I'm seeking second opinions on if replacing the boards is in order before I buy them. Lots of places have the out-of-stock but I found several on eBay for about $50 each.

Thanks....

Excel 2010: Need assistance with creating a lookup tool.

kaputcha — Thu, 23 May 2013 23:28:35 GMT

Hi,

I'm trying to create a simple lookup tool, which displays cable and equipment data relevant to a selection from a drop down menu. I have attached an example workbook.

There are three worksheets. The first, LOOKUP, has the dropdown menu, sourcing it's data for the list from the second worksheet, T_CODES. On the first worksheet I want one column that will display all of the cables relevant to the selction in the drop down menu. The third sheet, RAW_DATA, has the cable information listed under their respective systems (named by their Turnover Codes); notice how the different systems share some of the same cables.

My biggest difficulty is getting the Column "Cable Number" on the first sheet to dynamically populate the cables (down the sheet, in individual cells) depending on what Turnover Code is selected from the drop down list. Is this even possible?

The live workbook that will be used will contain a lot of data, hence why I'm trying to make an easy tool for people to use. They can simply select the Turnover Code for the system they are working on, and it will display all the cables that concern their system.

Any ideas on how I can do this, or am I coming at this from the wrong direction?

Cheers!

Attached Files

Example.xlsx (14.3 KB)

virus n error loading problem

errorloading — Thu, 23 May 2013 23:26:14 GMT

The following message keep coming up when I start my computer:
Kp Quicken Function.exe has encounter a problem and needs to close. We are sorry for the inconvenience.

Also the following error message appears:
Errorloading C:\WINDOWS\ojexiyayidad.dll

the specific module could not be found.

there are other unwanted website pops up as well.

Can u help me to fix it.

Thank you

Sound Troubles

b_alasdair — Thu, 23 May 2013 23:07:44 GMT

On a laptop running Windows 7, I'm having trouble with the sound. The sound device has somehow been set to Speakers & Headphones (IDT High Definition Audio CODEC), which is forcing about half of my sound playback through headphones (which I can't simply leave plugged in) and the other half through the speakers. For example, video call sounds come through the headphones, whilst system sounds come through speakers. What I need to do is set everything to come through the speakers unless the headphones are plugged in. The problem is, whether I go through Control Panel or my Taskbar, I can't seem to find a way to set it back to the default.

Gmail voice plugin problem

Ironlung — Thu, 23 May 2013 23:05:44 GMT

Greetings,
I have recently purchased an Accer Ultrabook equipped with Win 8 OS; I have tried to download the Gmail voice plug in to make calls via my Gmail but when I click on the link for the download, nothing happens, no download; I am launching Google CHrome from the desktop mode.
Let me know if there is anything I can do to solve this problem.

Cheers

APC Battery back up

dano_61 — Thu, 23 May 2013 22:39:26 GMT

My company is getting rid of a few APC 1500 battery back ups, what do they do , are they use to a house application

Dan

Do not know how bad my problem si but looks real bad

jraquel — Thu, 23 May 2013 22:32:10 GMT

I first noticed that on youtube,a video will start and run between 10 and 15 seconds and stop. Some videos before starting would say it needs to have adobe flash player to run. I reinstalled adobe but still no go. When I was installing adobe flash it would appear to stop downloading and I would have to "stop" and then restart it manually. This seems to be saying that downloads are stopping just like videos on youtube does.

I was using internet explorer 7, but decided I would try Mozilla Firefox and I get the same problem. Norton antivirus says there are no virus or malware on my computer. This just started within the last couple of days . Seems like I remember everything being ok on Wednesday May 22, 2013.

Anyone have such a problem or know a fix for this?

Thanks and Have a Great Day,
Jraquel

windows update freezes then reboots

patcaessr — Thu, 23 May 2013 22:05:44 GMT

At wits end , my desktop pc is Windows Vista , 3 days ago updated some drivers now screen shows �updating 3 of 3 0% don�t turn off computer� after 1 minute shuts down and restarts, never complete the download, I have tried the F8 last good config, still goes back to the update screen, loaded in safe mode nothing happens, in desperation put in the re installation operating system CD, that wouldn�t load up either, still starts up at that updating screen, checked the BIOS to ensure would boot from CD all correct but whatever I try just goes back to that same screen and keeps re-starting,cant get past that screen to do anything, all advice from Microsoft forum to find the fault hopeless because need to get into system to do the checks and repair, as this happened to anyone else and how can I get past it and into system, having to send this message on borrowed laptop

Help buying new motherboard

OmALY04 — Thu, 23 May 2013 21:58:46 GMT

My PC motherboard died about a week ago and since you guys helped me figure it out, I thought that you might also be able help me choose a new motherboard. Any suggestions would be really appreciated.

Slow internet

simricht — Thu, 23 May 2013 21:51:10 GMT

Hi, my Wi-Fi internet connection on my Vista is very slow or doesn't work at all many times, even though the icon at the notification area says that the connection is good, and other devices getting the same connection will work, can anyone help?

How to uninstall Revo Unintall software

jsklaroff — Thu, 23 May 2013 21:20:17 GMT

Hi,

I would like to unistall Revo Uninstall Pro, It is listed as an option in Control Panel. If I click on Programs and Features in Control Panel to uninstall it is not listed? I also have the software CCleaner and it is not listed in the remove program option. In Program Files/VS Revo Group there is not an uninstall option in that folder.

OS:Windows Vista Home Premium
Service Pack 2
AMD Athlon 64 X2 Dual Core Processor 4400+ 2.30GHz
4GB RAM
32 bit operating system

Thank you for your help.

Jay

virtual network

welf — Thu, 23 May 2013 21:08:40 GMT

I am a poor typist. Before posting details, I would like to know if anyone can help with configuring a network I am attempting to build entirely within VirtualBox. The firewall/router interface between VBox and the outside world is pfSense.

Thanks for your replies.

Windows 7 laptop connecting to network - mapped drives

don_1953 — Thu, 23 May 2013 20:47:18 GMT

I�m setting a new laptop for my boss, he will map to several network shares as it boots up. Each share requires a username and password. I mapped these drives, logged in the first time, put in the username and passwords etc with no problems. (we are not on a domain)
We have a DHCP server that gives the IP address to the Laptop.

When I reboot, I get a message from Windows �Could not connect to all Network drives� �Click here to check the status of your network drives�

I see all the mapped drives with little red x�s, clicking on them prompts me to enter a username and password, even though I�ve checked �remember my credentials�

He is going to be pissed if he has to put in his username and password every time he logs on, can you tell me how to fix this?

Is there a �network connection wizard� buried somewhere in Windows 7?

Windows 7 Restarts When I Establish Internet Connection

zkostrzewa — Thu, 23 May 2013 20:31:20 GMT

Hey All,

I have been having an issue with a Windows 7 Home Premium laptop where, when I establish a connection to the internet, it restarts. This happens if I connect to wireless or wired connections. I went so far as to perform a factory restore from the system partition and it is still doing it.

I came across this thread: http://forums.techguy.org/virus-othe...-internet.html and am having the same exact issue.

There were some instructions in that thread that were specific to that persons system so I was wondering if someone would be able to walk me through the steps to get rid of whatever is causing the issue on this laptop.

Thanks in advance!

Unable to install Win7

gurutech — Thu, 23 May 2013 20:22:00 GMT

A friend of mine got the FBI virus, so she backed up all her data, then began the process of a "system restore", but it did not work.

I've walked her through downloading the original ISO file for Win7 (Home Premium) from Digital River, and she has the product key attached to the side of her computer, so licensing isn't an issue.

I also had her download the USB-ISO tool, so she can make her USB drive bootable with the ISO, as she doesn't have blank DVD's to burn the ISO. I'm having her get some blank DVD's to see if that will work.

The problem is that the installation starts, and comes up with the "Install Now" button, and she clicks on that, but the install comes up asking for drivers for additional drives, as it can't find the existing Windows installation. I've tried having her remove the partition completely via "Diskpart", but that's proving too difficult (for her), and I can't get to her location to do this myself, as I'm about 2000 miles away, trying to do this all over facebook IM... lol

Anyone know what type of drivers this thing needs to get Win7 reinstalled? She doesn't have the factory disks, otherwise I would have just told her to stick that in and go from there...

Outlook Express attachments & Eudora

Kathy_H — Thu, 23 May 2013 20:16:19 GMT

Just earlier today I saw a post by Alex Ethridge regarding trying to find where Outlook attachments were stored on the hard drive. That posting is now Closed so I wasn't able to do a Reply. His posting also said that he used Eudora. I would like to ask with what server are you able to use the Eudora email program? I'm having a time finding a server who does. Presently, I'm using Outlook Express (in complete desperation), and I cannot find where it stores my attachments from incoming emails. It is supposed to be under Temporary Internet Files, but those files are hidden, even though I have checked Show Hidden Files in the Folder Options.

Thanks!

Open Office on Mac

Babs1 — Thu, 23 May 2013 20:13:34 GMT

Hello,
I am running Open Office on my iMac5, I want to print envelopes, how do I set up(step by step instructions would be great)

a data base to enable me to do this?
Many thanks for any help.

Solved: Vista hangs on shutdown (urgent please)

ycc — Thu, 23 May 2013 20:00:36 GMT

Hello,

I tried to shut down my Vista. (HP Pavillion)

It hangs on blue "Logging off ..." screen. No activity on disk for some hours.

No special activity lately, no updates etc.

Screensaver and hibernate works. F8 does not work after hibernate (maybe that is as it should be).

Nothing on ctrl/alt/del

Please I need urgent help. Computer completely hung.

Thanks.

ycc

Outlook 2010 - Mail Delay to Only One User on Domain

XpL0d3r — Thu, 23 May 2013 19:50:03 GMT

Exchange 2010

Client with the issue is running Outlook 2010 on Windows 7 Enterprise x64 (90% of users on this same OS). Desktop, hard wired on a steady internet connection.

With this user, some (not all) emails that are sent via a distribution group are delayed 5-20 minutes. For example, last week an email was sent out to all employees of our office at 4:50pm. This user got the email at 5:06pm. Looking at the header of the message, it does in fact show a time of 4:50. His send/receive settings match up with mine completely.

Anyone have any suggestions as of what to try next?

Thanks

Can't resize picture in irfanview

gtownflyer — Thu, 23 May 2013 19:35:25 GMT

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows 7 Home Premium, Service Pack 1, 64 bit
Processor: AMD Athlon(tm) II X4 635 Processor, AMD64 Family 16 Model 5 Stepping 3
Processor Count: 4
RAM: 3839 Mb
Graphics Card: ATI Radeon HD 4200, 256 Mb
Hard Drives: C: Total - 702932 MB, Free - 589223 MB; D: Total - 12368 MB, Free - 1511 MB;
Motherboard: FOXCONN, 2AB1
Antivirus: Microsoft Security Essentials, Updated and Enabled

I have been using IRFANVIEW for years with nary a problem, until the last few days.

When I try to RESIZE a picture nothing happens - what can I do to remedy this.

Thanks

ads over the speakers and slow computer

mmatt2004 — Thu, 23 May 2013 19:24:14 GMT

hello, There are ads playing over my speakers constantly even when no browsers are open. Also my cpu is running at 100 % all the time. I know I dont have the fastest computer, but its running deathly slow. My system clock is also very off, not keeping time. I tried doing a factory restore a few weeks ago, but that didnt help. I have a hp 2000-369wm notebook pc running windows 7. here is my log files:

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 12:08:11 PM, on 5/11/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v9.00 (9.00.8112.16421)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\matt\Downloads\HijackThis.exe
C:\Windows\SysWOW64\DllHost.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://g.msn.com/HPNOT/1
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://g.msn.com/HPNOT/1
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Norton Identity Protection - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll
O2 - BHO: Norton Vulnerability Protection - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\IPS\IPSBHO.DLL
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
O3 - Toolbar: Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coIEPlg.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~2\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [HPQuickWebProxy] "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
O4 - HKLM\..\Run: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe -update activex (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe -update activex (User 'Default user')
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll
O9 - Extra button: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O9 - Extra 'Tools' menuitem: @C:\Program Files (x86)\Evernote\Evernote\Resource.dll,-101 - {A95fe080-8f5d-11d2-a20b-00aa003c157a} - res://C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204 (file missing)
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files (x86)\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
O23 - Service: Andrea RT Filters Service (AERTFilters) - Andrea Electronics Corporation - C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: AMD FUEL Service - Advanced Micro Devices, Inc. - C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: GamesAppService - WildTangent, Inc. - C:\Program Files (x86)\WildTangent Games\App\GamesAppService.exe
O23 - Service: HP Support Assistant Service - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
O23 - Service: HP Client Services (HPClientSvc) - Hewlett-Packard Company - C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
O23 - Service: HP Quick Synchronization Service (HPDrvMntSvc.exe) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
O23 - Service: HP Software Framework Service (hpqwmiex) - Hewlett-Packard Company - C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
O23 - Service: HPWMISVC - Hewlett-Packard Development Company, L.P. - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Norton Internet Security (NIS) - Symantec Corporation - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: RoxioNow Service - Roxio - C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)
O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

--
End of file - 9953 bytes

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 9.0.8112.16421 BrowserJavaVersion: 10.21.2
Run by matt at 12:02:22 on 2013-05-11
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\atieclxx.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Realtek\Audio\HDA\AERTSr64.exe
C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files\Hewlett-Packard\HP Client Services\HPClientServices.exe
C:\Program Files (x86)\Hewlett-Packard\Shared\HPDrvMntSvc.exe
C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPWMISVC.exe
C:\Program Files (x86)\Realtek\Realtek PCIE Card Reader\RIconMan.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\Program Files (x86)\Roxio\RoxioNow Player\RNowSvc.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ccSvcHst.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\taskmgr.exe
C:\Windows\System32\perfmon.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe
C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\taskeng.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\taskeng.exe
C:\Users\matt\Downloads\HijackThis(1).exe
C:\Users\matt\Downloads\HijackThis.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
mWinlogon: Userinit = userinit.exe
BHO: &Yahoo! Toolbar Helper: {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: Norton Identity Protection: {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
BHO: Norton Vulnerability Protection: {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\ips\ipsbho.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
TB: Norton Toolbar: {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\19.9.1.14\coieplg.dll
TB: Yahoo! Toolbar: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files (x86)\Yahoo!\Companion\Installs\cpn0\yt.dll
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [HPQuickWebProxy] "C:\Program Files (x86)\Hewlett-Packard\HP QuickWeb\hpqwutils.exe"
mRun: [HP Quick Launch] C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
dRunOnce: [FlashPlayerUpdate] C:\Windows\SysWOW64\Macromed\Flash\FlashUtil10q_ActiveX.exe -update activex
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBC} - C:\Program Files (x86)\Java\jre7\bin\jp2iexp.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
IE: {A95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\Program Files (x86)\Evernote\Evernote\EvernoteIE.dll/204
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
DPF: {CAFEEFAC-0015-0000-0000-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.5.0/jinstall-1_5_0-windows-i586.cab
TCP: NameServer = 10.0.0.1
TCP: Interfaces\{7160ECF7-6668-4539-9AEE-174F9E247A1C} : DHCPNameServer = 10.0.0.1
TCP: Interfaces\{A1E67B58-BB03-4C30-A80E-227BCBFC9523} : DHCPNameServer = 10.0.0.1
Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
SSODL: WebCheck -
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Handler: wlpg - {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} -
x64-SSODL: WebCheck -
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\matt\AppData\Roaming\Mozilla\Firefox\Profiles\4js2esrz.default\
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\WildTangent Games\App\BrowserIntegration\Registered\0\NP_wtapp.dll
FF - plugin: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
FF - plugin: C:\Windows\SysWOW64\npDeployJava1.dll
FF - plugin: C:\Windows\SysWOW64\npmproxy.dll
FF - ExtSQL: 2013-05-11 11:40; {2D3F3651-74B9-4795-BDEC-6DA2F431CB62}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\coFFPlgn
FF - ExtSQL: 2013-05-11 11:41; {BBDA0591-3099-440a-AA10-41764D9DB4DB}; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.0.0.128\IPSFFPlgn
FF - ExtSQL: 2013-05-11 11:56; {635abd67-4fe9-1b23-4f01-e679fa7484c1}; C:\Users\matt\AppData\Roaming\Mozilla\Firefox\Profiles\4js2esrz.default\ext ensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
.
---- FIREFOX POLICIES ----

============= SERVICES / DRIVERS ===============
.
R? clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86
R? clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64
R? clwvd;CyberLink WebCam Virtual Driver
R? GamesAppService;GamesAppService
R? SrvHsfHDA;SrvHsfHDA
R? SrvHsfV92;SrvHsfV92
R? SrvHsfWinac;SrvHsfWinac
R? TsUsbFlt;TsUsbFlt
R? TsUsbGD;Remote Desktop Generic USB Device
R? USBAAPL64;Apple Mobile USB Driver
R? wlcrasvc;Windows Live Mesh remote connections service
S? AERTFilters;Andrea RT Filters Service
S? AMD External Events Utility;AMD External Events Utility
S? AMD FUEL Service;AMD FUEL Service
S? amd_sata;amd_sata
S? amd_xata;amd_xata
S? amdiox64;AMD IO Driver
S? BHDrvx64;BHDrvx64
S? ccSet_NIS;Norton Internet Security Settings Manager
S? EraserUtilRebootDrv;EraserUtilRebootDrv
S? HP Support Assistant Service;HP Support Assistant Service
S? HPClientSvc;HP Client Services
S? HPDrvMntSvc.exe;HP Quick Synchronization Service
S? HPWMISVC;HPWMISVC
S? IconMan_R;IconMan_R
S? IDSVia64;IDSVia64
S? netr28x;Ralink 802.11n Extensible Wireless Driver
S? NIS;Norton Internet Security
S? RoxioNow Service;RoxioNow Service
S? RSPCIESTOR;Realtek PCIE CardReader Driver
S? RTL8167;Realtek 8167 NT Driver
S? SymDS;Symantec Data Store
S? SymEFA;Symantec Extended File Attributes
S? SymIRON;Symantec Iron Driver
S? SymNetS;Symantec Network Security WFP Driver
S? usbfilter;AMD USB Filter Driver
.
=============== Created Last 30 ================
.
2013-05-11 16:17:50 866720 ----a-w- C:\Windows\SysWow64\npDeployJava1.dll
2013-05-11 16:17:50 788896 ----a-w- C:\Windows\SysWow64\deployJava1.dll
2013-05-11 16:17:40 95648 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-05-11 16:07:18 -------- d-----w- C:\Users\matt\AppData\Local\Mixxx
2013-05-11 16:06:43 -------- d-----w- C:\Users\matt\AppData\Local\Apple Computer
2013-05-11 16:05:57 33240 ----a-w- C:\Windows\System32\drivers\GEARAspiWDM.sys
2013-05-11 16:05:13 -------- d-----w- C:\Program Files\iPod
2013-05-11 16:05:10 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-05-11 16:05:10 -------- d-----w- C:\Program Files\iTunes
2013-05-11 16:05:10 -------- d-----w- C:\Program Files (x86)\iTunes
2013-05-11 15:57:49 -------- d-----w- C:\Program Files (x86)\iPhoneBrowser
2013-05-11 15:51:12 -------- d-----w- C:\Users\matt\AppData\Local\AMD
2013-05-11 15:50:35 -------- d-----w- C:\Users\matt\AppData\Local\ATI
2013-05-11 15:49:29 -------- d-----w- C:\Users\matt\AppData\Roaming\hpqLog
2013-05-11 15:49:14 -------- d-----w- C:\Users\matt\AppData\Roaming\Synaptics
2013-05-11 15:49:10 -------- d-----w- C:\Users\matt\AppData\Local\CrashDumps
2013-05-11 15:48:37 737952 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\srtsp64.sys
2013-05-11 15:48:37 451192 ----a-r- C:\Windows\System32\drivers\NISx64\1309010.00E\symds64.sys
2013-05-11 15:48:37 405624 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\symnets.sys
2013-05-11 15:48:37 37536 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\srtspx64.sys
2013-05-11 15:48:37 190072 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\ironx64.sys
2013-05-11 15:48:37 167072 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\ccsetx64.sys
2013-05-11 15:48:37 1129120 ----a-w- C:\Windows\System32\drivers\NISx64\1309010.00E\symefa64.sys
2013-05-11 15:48:35 -------- d-----w- C:\Users\matt\AppData\Local\Spotify
2013-05-11 15:48:26 -------- d-----w- C:\Windows\System32\drivers\NISx64\1309010.00E
2013-05-11 15:47:16 -------- d-----w- C:\Program Files (x86)\Yahoo!
2013-05-11 15:45:48 -------- d-----w- C:\Users\matt\AppData\Local\VirtualStore
2013-05-11 15:45:43 -------- d-----w- C:\Users\matt\AppData\Local\Apple
2013-05-11 15:45:41 -------- d-----w- C:\Users\matt\AppData\Local\RemEngine
2013-05-11 15:45:17 -------- d-----w- C:\Users\matt\AppData\Roaming\Spotify
2013-05-11 15:43:57 -------- d-----w- C:\Users\matt\AppData\Local\Adobe
2013-05-11 15:43:41 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-05-11 15:43:25 -------- d-----w- C:\Users\matt\AppData\Local\Mozilla
2013-05-11 15:43:12 -------- d-----w- C:\Users\matt\AppData\Local\Hewlett-Packard
2013-05-11 15:43:11 -------- d-----w- C:\Windows\SysWow64\%COREALLUSERPATH%
2013-05-11 15:43:04 -------- d-----w- C:\Program Files (x86)\Mozilla Maintenance Service
2013-05-11 15:40:38 -------- d-----w- C:\Users\matt\AppData\Local\Wide Angle Software
2013-05-11 15:39:10 2622464 ----a-w- C:\Windows\System32\wucltux.dll
2013-05-11 15:39:04 -------- d-----w- C:\Program Files (x86)\Wide Angle Software
2013-05-11 15:37:30 -------- d-----w- C:\Program Files (x86)\Common Files\Symantec Shared
.
==================== Find3M ====================
.
2013-05-11 15:45:04 175736 ----a-w- C:\Windows\System32\drivers\SYMEVENT64x86.SYS
2013-05-11 15:43:41 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
.
============= FINISH: 12:09:32.45 ===============

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 5/11/2013 11:37:53 AM
System Uptime: 5/11/2013 11:36:25 AM (1 hours ago)
.
Motherboard: Hewlett-Packard | | 3577
Processor: AMD E-450 APU with Radeon(tm) HD Graphics | Socket FT1 | 1650/100mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 447 GiB total, 413.138 GiB free.
D: is FIXED (NTFS) - 15 GiB total, 1.625 GiB free.
E: is FIXED (FAT32) - 4 GiB total, 1.084 GiB free.
F: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP9: 5/11/2013 11:38:00 AM - Installed TouchCopy 12
RP4: 5/11/2013 11:46:00 AM - Installed iTunes
RP11: 5/11/2013 11:46:58 AM - Removed HP Documentation
RP12: 5/11/2013 11:53:17 AM - Removed Evernote v. 4.2.3
RP6: 5/11/2013 11:55:51 AM - Installed iPhoneBrowser
RP3: 5/11/2013 11:56:07 AM - Installed J2SE Runtime Environment 5.0
RP5: 5/11/2013 12:00:12 PM - Installed iTunes
RP7: 5/11/2013 12:01:11 PM - Configured YouCam
RP8: 5/11/2013 12:11:43 PM - Windows Update
RP10: 5/11/2013 12:16:22 PM - Installed Java 7 Update 21
.
==== Installed Programs ======================
.
Adobe Flash Player 11 ActiveX
Adobe Reader X MUI
Adobe Shockwave Player 11.5
Agatha Christie - Peril at End House
AMD APP SDK Runtime
AMD Fuel
AMD Media Foundation Decoders
AMD VISION Engine Control Center
Apple Application Support
Apple Mobile Device Support
Apple Software Update
ATI Catalyst Install Manager
Bejeweled 3
Blackhawk Striker 2
Blasterball 3
Blio
Bonjour
Bounce Symphony
Cake Mania
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
Chronicles of Albian
Chuzzle Deluxe
Cradle of Rome 2
D3DX10
ESU for Microsoft Windows 7 SP1
Evernote v. 4.2.3
Farm Frenzy
FATE
Governor of Poker 2 Premium Edition
Hewlett-Packard ACLM.NET v1.1.1.0
HP Auto
HP Client Services
HP Customer Experience Enhancements
HP Games
HP Launch Box
HP MovieStore
HP On Screen Display
HP Power Manager
HP Quick Launch
HP QuickWeb
HP Setup
HP Setup Manager
HP Software Framework
HP Support Assistant
iPhoneBrowser
iTunes
J2SE Runtime Environment 5.0
Java 7 Update 21
Java Auto Updater
Jewel Quest: The Sleepless Star - Collector's Edition
Junk Mail filter update
Mah Jong Medley
Mesh Runtime
Microsoft .NET Framework 4 Client Profile
Microsoft Application Error Reporting
Microsoft Office 2010
Microsoft Silverlight
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
Microsoft WSE 3.0 Runtime
Mixxx 1.11.0 (64-bit)
Mozilla Firefox 20.0.1 (x86 en-US)
Mozilla Maintenance Service
MSVCRT
MSVCRT_amd64
Mystery of Mortlake Mansion
Namco All-Stars: PAC-MAN
Norton Internet Security
Penguins!
Plants vs. Zombies - Game of the Year
PlayReady PC Runtime x86
Poker Superstars III
Polar Bowler
Polar Golfer
Ralink RT5390 802.11b/g/n WiFi Adapter
Realtek Ethernet Controller Driver
Realtek High Definition Audio Driver
Realtek PCIE Card Reader
Recovery Manager
RoxioNow Player
Slingo Supreme
Spotify
Synaptics TouchPad Driver
TouchCopy 12
Update Installer for WildTangent Games App
Vacation Quest - The Hawaiian Islands
Virtual Villagers 5 - New Believers
WildTangent Games App (HP Games)
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Installer
Windows Live Language Selector
Windows Live Mail
Windows Live Mesh
Windows Live Mesh ActiveX Control for Remote Connections
Windows Live Messenger
Windows Live MIME IFilter
Windows Live Movie Maker
Windows Live Photo Common
Windows Live Photo Gallery
Windows Live PIMT Platform
Windows Live Remote Client
Windows Live Remote Client Resources
Windows Live Remote Service
Windows Live Remote Service Resources
Windows Live SOXE
Windows Live SOXE Definitions
Windows Live UX Platform
Windows Live UX Platform Language Pack
Windows Live Writer
Windows Live Writer Resources
Yahoo! Messenger
Yahoo! Software Update
Yahoo! Toolbar
Zuma Deluxe
.
==== Event Viewer Messages From Past Week ========
.
5/11/2013 12:35:17 PM, Error: Service Control Manager [7000] - The Multimedia Class Scheduler service failed to start due to the following error: The client of a component requested an operation which is not valid given the state of the component instance.
5/11/2013 11:48:29 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the IKEEXT service.
5/11/2013 11:45:59 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Multimedia Class Scheduler service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:45:58 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Windows Management Instrumentation service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:44:58 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Application Experience service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7034] - The Application Information service terminated unexpectedly. It has done this 1 time(s).
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Windows Update service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Windows Management Instrumentation service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The User Profile Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Themes service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Task Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The System Event Notification Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Shell Hardware Detection service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Server service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Multimedia Class Scheduler service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The IP Helper service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The IKE and AuthIP IPsec Keying Modules service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Group Policy Client service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Extensible Authentication Protocol service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Computer Browser service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 120000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Background Intelligent Transfer Service service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:58 AM, Error: Service Control Manager [7031] - The Application Experience service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
5/11/2013 11:43:29 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the User Profile Service service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:43:29 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the IKE and AuthIP IPsec Keying Modules service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:43:29 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Computer Browser service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:42:29 AM, Error: Service Control Manager [7032] - The Service Control Manager tried to take a corrective action (Restart the service) after the unexpected termination of the Server service, but this action failed with the following error: An instance of the service is already running.
5/11/2013 11:41:26 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the AeLookupSvc service.
5/11/2013 11:41:26 AM, Error: Service Control Manager [7000] - The Application Experience service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/11/2013 11:40:56 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the wuauserv service.
5/11/2013 11:40:56 AM, Error: Service Control Manager [7000] - The Windows Update service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
5/11/2013 11:36:36 AM, Error: Service Control Manager [7011] - A timeout (30000 milliseconds) was reached while waiting for a transaction response from the MMCSS service.
5/11/2013 11:36:36 AM, Error: Service Control Manager [7000] - The Multimedia Class Scheduler service failed to start due to the following error: The service did not respond to the start or control request in a timely fashion.
.
==== End Of File ===========================

GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-11 12:20:04
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000069 TOSHIBA_ rev.GS00 465.76GB
Running: vful24gu.exe; Driver: C:\Users\matt\AppData\Local\Temp\kwldypow.sys

---- Threads - GMER 2.1 ----

Thread C:\Windows\SysWOW64\ntdll.dll [2492:2496] 0000000001080d9a
Thread C:\Windows\SysWOW64\ntdll.dll [2492:4728] 000000006766e196

---- EOF - GMER 2.1 ----

thanks, matt

cannot access internet

pallone1 — Thu, 23 May 2013 19:20:07 GMT

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft� Windows Vista� Home Premium, Service Pack 2, 32 bit
Processor: Genuine Intel(R) CPU T2250 @ 1.73GHz, x86 Family 6 Model 14 Stepping 8
Processor Count: 2
RAM: 2045 Mb
Graphics Card: ATI Mobility Radeon X1300, 64 Mb
Hard Drives: C: Total - 140289 MB, Free - 71609 MB; D: Total - 10239 MB, Free - 4 MB;
Motherboard: Dell Inc., 0XD720
Antivirus: Microsoft Security Essentials, Updated and Enabled

I am having a problem with my PC, a dell inspiron I6400. My ISP is Verizon. The info provided above is for my laptop , but my PC also has Windows Vista home premium Service Pack 2 32 bit.
I can't connect on my pc. When i try to access my network and sharing center, I get the following message:
"Connection status unknown. The dependency servive or group failed to start". I called my ISP and they checked the modem and ethernet cable connection and it was operating properly. My laptop that I'm using to contact you connects wirelessly and is working fine. Can you provide me with a fix so I can reconnect to the internet on my PC?

Virus Scanners not working

Gubbo — Thu, 23 May 2013 18:54:57 GMT

Hi,

Concerned I have viruses or something bad on my computer as when I try to run virus scans, they freeze the computer and so I have to close the whole thing down.
I have tried running scans with Avast! and Malwarebytes and they both freeze.

I have seen a couple of dodgy programs in control panel but when I try to remove them, they come back - so basically want to make sure the computer is not infected with anything and get it back to normal.

HIJACK THIS
Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 19:25:26, on 23/05/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16576)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Users\Gubbins\Desktop\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = Preserve
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://feed.snap.do/?publisher=TightropeYB&dpid=TightropeYB&co=GB&userid=e65b88a2-1a0a-4c32-b8a1-5756716edcbd&searchtype=ds&q={searchTerms}&installDate=06/03/2013
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/p/?LinkId=255141
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,Default_Search_URL = http://feed.snap.do/?publisher=TightropeYB&dpid=TightropeYB&co=GB&userid=e65b88a2-1a0a-4c32-b8a1-5756716edcbd&searchtype=ds&q={searchTerms}&installDate=06/03/2013
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://feed.snap.do/?publisher=TightropeYB&dpid=TightropeYB&co=GB&userid=e65b88a2-1a0a-4c32-b8a1-5756716edcbd&searchtype=ds&q={searchTerms}&installDate=06/03/2013
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
F2 - REG:system.ini: UserInit=userinit.exe,
O2 - BHO: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O2 - BHO: SkypeIEPluginBHO - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O2 - BHO: Ask Toolbar BHO - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: TOSHIBA Media Controller Plug-in - {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
O3 - Toolbar: avast! Online Security - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
O3 - Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - (no file)
O3 - Toolbar: Nero Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
O4 - HKLM\..\Run: [NBAgent] "c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
O4 - HKLM\..\Run: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
O4 - HKLM\..\Run: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
O4 - HKLM\..\Run: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
O4 - HKLM\..\Run: [KeNotify] "C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe" LPCM
O4 - HKLM\..\Run: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot
O4 - HKCU\..\Run: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background
O4 - HKUS\S-1-5-18\..\Run: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe (User 'Default user')
O4 - .DEFAULT User Startup: TRDCReminder.lnk = C:\Program Files (x86)\TOSHIBA\TRDCReminder\TRDCReminder.exe (User 'Default user')
O9 - Extra button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O9 - Extra 'Tools' menuitem: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O18 - Protocol: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: AMD External Events Utility - Unknown owner - C:\Windows\system32\atiesrxx.exe (file missing)
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: ConfigFree WiMAX Service (cfWiMAXService) - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
O23 - Service: ConfigFree Service - TOSHIBA CORPORATION - C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: @%SystemRoot%\system32\efssvc.dll,-100 (EFS) - Unknown owner - C:\Windows\System32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\fxsresm.dll,-118 (Fax) - Unknown owner - C:\Windows\system32\fxssvc.exe (file missing)
O23 - Service: IconMan_R - Realsil Microelectronics Inc. - C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: Nero BackItUp Scheduler 4.0 - Nero AG - c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Skype Updater (SkypeUpdate) - Skype Technologies - C:\Program Files (x86)\Skype\Updater\Updater.exe
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: @%SystemRoot%\system32\sppsvc.exe,-101 (sppsvc) - Unknown owner - C:\Windows\system32\sppsvc.exe (file missing)
O23 - Service: TeamViewer 7 (TeamViewer7) - TeamViewer GmbH - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
O23 - Service: Notebook Performance Tuning Service (TEMPRO) (TemproMonitoringService) - Toshiba Europe GmbH - C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe
O23 - Service: TMachInfo - TOSHIBA Corporation - C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe
O23 - Service: TOSHIBA Optical Disc Drive Service (TODDSrv) - Unknown owner - C:\Windows\system32\TODDSrv.exe (file missing)
O23 - Service: TOSHIBA Power Saver (TosCoSrv) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
O23 - Service: TOSHIBA HDD SSD Alert Service - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vaultsvc.dll,-1003 (VaultSvc) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Wat\WatUX.exe,-601 (WatAdminSvc) - Unknown owner - C:\Windows\system32\Wat\WatAdminSvc.exe (file missing)
O23 - Service: @%systemroot%\system32\wbengine.exe,-104 (wbengine) - Unknown owner - C:\Windows\system32\wbengine.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 10608 bytes

DDS
DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16576
Run by Gubbins at 19:26:20 on 2013-05-23
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.44.1033.18.2812.1504 [GMT 1:00]
.
AV: avast! Antivirus *Enabled/Updated* {2B2D1395-420B-D5C9-657E-930FE358FC3C}
SP: avast! Antivirus *Enabled/Updated* {904CF271-6431-DA47-5FCE-A87D98DFB681}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\system32\atiesrxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\atieclxx.exe
C:\Program Files\AVAST Software\Avast\AvastSvc.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe
c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe
C:\Windows\system32\TODDSrv.exe
C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe
C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe
C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe
C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe
C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe
C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe
C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe
C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe
C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe
C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe
C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe
C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe
C:\Windows\system32\taskeng.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\AVAST Software\Avast\AvastUI.exe
C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSwMgr.exe
C:\Program Files (x86)\Opera\opera.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe
C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\taskhost.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uSearch Bar = Preserve
uSearch Page = hxxp://feed.snap.do/?publisher=TightropeYB&dpid=TightropeYB&co=GB&userid=e65b88a2-1a0a-4c32-b8a1-5756716edcbd&searchtype=ds&q={searchTerms}&installDate=06/03/2013
uSearchAssistant = hxxp://feed.snap.do/?publisher=TightropeYB&dpid=TightropeYB&co=GB&userid=e65b88a2-1a0a-4c32-b8a1-5756716edcbd&searchtype=ds&q={searchTerms}&installDate=06/03/2013
mWinlogon: Userinit = userinit.exe,
BHO: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
BHO: Skype Browser Helper: {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
BHO: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
BHO: TOSHIBA Media Controller Plug-in: {F3C88694-EFFA-4d78-B409-54B7B2535B14} - C:\Program Files (x86)\TOSHIBA\TOSHIBA Media Controller Plug-in\TOSHIBAMediaControllerIE.dll
TB: avast! Online Security: {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
TB: : {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 -
TB: Nero Toolbar: {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll
uRun: [WinPatrol] C:\Program Files (x86)\BillP Studios\WinPatrol\winpatrol.exe -expressboot
uRun: [FileHippo.com] "C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe" /background
mRun: [NBAgent] "c:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe" /WinStart
mRun: [StartCCC] "C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun
mRun: [SVPWUTIL] C:\Program Files (x86)\TOSHIBA\Utilities\SVPWUTIL.exe SVPwUTIL
mRun: [HWSetup] C:\Program Files\TOSHIBA\Utilities\HWSetup.exe hwSetUP
mRun: [KeNotify] "C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe" LPCM
mRun: [TWebCamera] "C:\Program Files (x86)\TOSHIBA\TOSHIBA Web Camera Application\TWebCamera.exe" autorun
mRun: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
dRun: [TOSHIBA Online Product Information] C:\Program Files (x86)\TOSHIBA\TOSHIBA Online Product Information\topi.exe
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoActiveDesktopChanges = dword:1
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-System: ConsentPromptBehaviorUser = dword:3
mPolicies-System: EnableUIADesktopToggle = dword:0
IE: {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab
TCP: NameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{8D4190F4-D4B5-462F-A6C4-CB88E18C5670} : DHCPNameServer = 194.168.4.100 194.168.8.100
TCP: Interfaces\{8D4190F4-D4B5-462F-A6C4-CB88E18C5670}\4596D6F6478697 : DHCPNameServer = 192.168.0.1
TCP: Interfaces\{93771F3B-6276-44FE-8A45-D5313DE90EAD} : DHCPNameServer = 192.168.0.1
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck -
x64-BHO: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-TB: avast! Online Security: {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Program Files\AVAST Software\Avast\aswWebRepIE64.dll
x64-TB: : {ae07101b-46d4-4a98-af68-0333ea26e113} - LocalServer32 -
x64-Run: [TosNC] C:\Program Files (x86)\Toshiba\BulletinBoard\TosNcCore.exe
x64-Run: [TosReelTimeMonitor] C:\Program Files (x86)\TOSHIBA\ReelTime\TosReelTimeMonitor.exe
x64-Run: [Toshiba TEMPRO] C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe
x64-Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s
x64-Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe /FORPCEE3
x64-Run: [TPwrMain] C:\Program Files (x86)\TOSHIBA\Power Saver\TPwrMain.EXE
x64-Run: [SmoothView] C:\Program Files (x86)\Toshiba\SmoothView\SmoothView.exe
x64-Run: [00TCrdMain] C:\Program Files (x86)\TOSHIBA\FlashCards\TCrdMain.exe
x64-Run: [SynTPEnh] C:\Program Files (x86)\Synaptics\SynTP\SynTPEnh.exe
x64-Run: [TosSENotify] C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosWaitSrv.exe
x64-Run: [SmartFaceVWatcher] C:\Program Files (x86)\Toshiba\SmartFaceV\SmartFaceVWatcher.exe
x64-Run: [TosVolRegulator] C:\Program Files\TOSHIBA\TosVolRegulator\TosVolRegulator.exe
x64-Run: [Toshiba Registration] C:\Program Files\Toshiba\Registration\ToshibaReminder.exe
x64-Run: [IntelliType Pro] "C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"
x64-Run: [IntelliPoint] "C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"
x64-Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -
x64-SSODL: WebCheck -
.
============= SERVICES / DRIVERS ===============
.
R0 aswRvrt;aswRvrt;C:\Windows\System32\drivers\aswRvrt.sys [2013-3-25 65336]
R0 aswVmm;aswVmm;C:\Windows\System32\drivers\aswVmm.sys [2013-3-25 189936]
R1 aswSnx;aswSnx;C:\Windows\System32\drivers\aswSnx.sys [2012-1-9 1025808]
R1 aswSP;aswSP;C:\Windows\System32\drivers\aswSP.sys [2012-1-9 378432]
R2 AMD External Events Utility;AMD External Events Utility;C:\Windows\System32\atiesrxx.exe [2011-11-28 203264]
R2 aswFsBlk;aswFsBlk;C:\Windows\System32\drivers\aswFsBlk.sys [2012-1-9 33400]
R2 aswMonFlt;aswMonFlt;C:\Windows\System32\drivers\aswMonFlt.sys [2012-1-9 80816]
R2 avast! Antivirus;avast! Antivirus;C:\Program Files\AVAST Software\Avast\AvastSvc.exe [2013-5-21 46808]
R2 cfWiMAXService;ConfigFree WiMAX Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe [2010-1-28 249200]
R2 ConfigFree Service;ConfigFree Service;C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe [2009-3-10 46448]
R2 cvhsvc;Client Virtualization Handler;C:\Program Files (x86)\Common Files\microsoft shared\Virtualization Handler\CVHSVC.EXE [2012-1-4 822624]
R2 IconMan_R;IconMan_R;C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe [2011-11-28 1811456]
R2 sftlist;Application Virtualization Client;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-1 508776]
R2 TeamViewer7;TeamViewer 7;C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe [2012-1-30 3027840]
R2 Yontoo Desktop Updater;Yontoo Desktop Updater;C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe [2013-3-6 23552]
R3 CeKbFilter;CeKbFilter;C:\Windows\System32\drivers\CeKbFilter.sys [2011-11-28 20592]
R3 PGEffect;Pangu effect driver;C:\Windows\System32\drivers\PGEffect.sys [2011-11-28 35008]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2010-8-31 344680]
R3 RTL8192Ce;Realtek Wireless LAN 802.11n PCI-E NIC Driver;C:\Windows\System32\drivers\rtl8192ce.sys [2011-11-28 932384]
R3 Sftfs;Sftfs;C:\Windows\System32\drivers\Sftfslh.sys [2011-10-1 764264]
R3 Sftplay;Sftplay;C:\Windows\System32\drivers\Sftplaylh.sys [2011-10-1 268648]
R3 Sftredir;Sftredir;C:\Windows\System32\drivers\Sftredirlh.sys [2011-10-1 25960]
R3 Sftvol;Sftvol;C:\Windows\System32\drivers\Sftvollh.sys [2011-10-1 22376]
R3 sftvsa;Application Virtualization Service Agent;C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-1 219496]
R3 TOSHIBA HDD SSD Alert Service;TOSHIBA HDD SSD Alert Service;C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe [2010-2-5 137560]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-2-28 161384]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;C:\Windows\System32\drivers\RtsUStor.sys [2011-11-28 232992]
S3 TemproMonitoringService;Notebook Performance Tuning Service (TEMPRO);C:\Program Files (x86)\Toshiba TEMPRO\TemproSvc.exe [2010-5-11 124368]
S3 TMachInfo;TMachInfo;C:\Program Files (x86)\TOSHIBA\TOSHIBA Service Station\TMachInfo.exe [2011-11-28 51512]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2012-1-15 59392]
S3 USBAAPL64;Apple Mobile USB Driver;C:\Windows\System32\drivers\usbaapl64.sys [2012-7-9 52736]
S3 WatAdminSvc;Windows Activation Technologies Service;C:\Windows\System32\Wat\WatAdminSvc.exe [2012-1-13 1255736]
.
=============== Created Last 30 ================
.
2013-05-23 17:05:20 -------- d-----w- C:\Program Files (x86)\Ask.com
2013-05-21 09:53:19 -------- d-----w- C:\Users\Gubbins\AppData\Roaming\Malwarebytes
2013-05-21 09:53:03 -------- d-----w- C:\ProgramData\Malwarebytes
2013-05-21 09:53:00 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2013-05-21 09:53:00 -------- d-----w- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-05-21 09:52:39 -------- d-----w- C:\Users\Gubbins\AppData\Local\Programs
2013-05-21 09:30:46 -------- d-----w- C:\Program Files\iPod
2013-05-21 09:30:45 -------- d-----w- C:\ProgramData\34BE82C4-E596-4e99-A191-52C6199EBF69
2013-05-21 09:30:45 -------- d-----w- C:\Program Files\iTunes
2013-05-21 09:30:45 -------- d-----w- C:\Program Files (x86)\iTunes
2013-05-21 09:25:07 9460464 ----a-w- C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{09E7F397-A643-46BC-967F-6D9D761D8D8D}\mpengine.dll
2013-05-21 07:31:27 -------- d-----w- C:\Program Files (x86)\FileHippo.com
2013-05-21 07:28:09 -------- d-----w- C:\Users\Gubbins\AppData\Roaming\WinPatrol
2013-05-21 07:28:04 -------- d-----w- C:\ProgramData\InstallMate
2013-05-21 07:28:04 -------- d-----w- C:\Program Files (x86)\BillP Studios
2013-05-01 16:52:46 108448 ----a-w- C:\Windows\System32\WindowsAccessBridge-64.dll
2013-04-24 15:44:02 1656680 ----a-w- C:\Windows\System32\drivers\ntfs.sys
.
==================== Find3M ====================
.
2013-05-15 19:15:11 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-05-15 19:15:11 692104 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-05-09 08:59:07 72016 ----a-w- C:\Windows\System32\drivers\aswRdr2.sys
2013-05-09 08:59:07 65336 ----a-w- C:\Windows\System32\drivers\aswRvrt.sys
2013-05-09 08:59:07 189936 ----a-w- C:\Windows\System32\drivers\aswVmm.sys
2013-05-09 08:59:07 1025808 ----a-w- C:\Windows\System32\drivers\aswSnx.sys
2013-05-09 08:59:06 80816 ----a-w- C:\Windows\System32\drivers\aswMonFlt.sys
2013-05-09 08:58:37 41664 ----a-w- C:\Windows\avastSS.scr
2013-05-02 01:06:08 278800 ------w- C:\Windows\System32\MpSigStub.exe
2013-05-01 16:52:39 971680 ----a-w- C:\Windows\System32\deployJava1.dll
2013-05-01 16:52:39 1092512 ----a-w- C:\Windows\System32\npDeployJava1.dll
2013-04-23 14:14:05 57 ----a-w- C:\ProgramData\ocejolb.bat
2013-04-23 14:14:05 153 ----a-w- C:\ProgramData\ocejolb.reg
2013-04-23 14:13:51 44544 ----a-w- C:\ProgramData\rundll32.exe
2013-04-13 05:49:23 135168 ----a-w- C:\Windows\apppatch\AppPatch64\AcXtrnal.dll
2013-04-13 05:49:19 350208 ----a-w- C:\Windows\apppatch\AppPatch64\AcLayers.dll
2013-04-13 05:49:19 308736 ----a-w- C:\Windows\apppatch\AppPatch64\AcGenral.dll
2013-04-13 05:49:19 111104 ----a-w- C:\Windows\apppatch\AppPatch64\acspecfc.dll
2013-04-13 04:45:16 474624 ----a-w- C:\Windows\apppatch\AcSpecfc.dll
2013-04-13 04:45:15 2176512 ----a-w- C:\Windows\apppatch\AcGenral.dll
2013-04-10 06:01:54 265064 ----a-w- C:\Windows\System32\drivers\dxgmms1.sys
2013-04-10 06:01:53 983400 ----a-w- C:\Windows\System32\drivers\dxgkrnl.sys
2013-04-10 03:30:50 3153920 ----a-w- C:\Windows\System32\win32k.sys
2013-04-06 06:51:22 9728 ---ha-w- C:\Windows\SysWow64\api-ms-win-downlevel-shlwapi-l1-1-0.dll
2013-04-05 06:52:14 2242048 ----a-w- C:\Windows\System32\wininet.dll
2013-04-05 06:50:36 3958784 ----a-w- C:\Windows\System32\jscript9.dll
2013-04-05 06:50:31 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-04-05 06:50:31 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-04-05 05:28:24 1767424 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-04-05 05:26:26 2877440 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-04-05 05:26:21 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-04-05 05:26:21 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-04-05 04:43:00 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-04-05 04:29:45 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-04-05 03:51:11 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-04-05 03:38:25 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-03-19 06:04:06 5550424 ----a-w- C:\Windows\System32\ntoskrnl.exe
2013-03-19 05:53:58 48640 ----a-w- C:\Windows\System32\wwanprotdim.dll
2013-03-19 05:53:58 230400 ----a-w- C:\Windows\System32\wwansvc.dll
2013-03-19 05:46:56 43520 ----a-w- C:\Windows\System32\csrsrv.dll
2013-03-19 05:04:13 3968856 ----a-w- C:\Windows\SysWow64\ntkrnlpa.exe
2013-03-19 05:04:10 3913560 ----a-w- C:\Windows\SysWow64\ntoskrnl.exe
2013-03-19 04:47:50 6656 ----a-w- C:\Windows\SysWow64\apisetschema.dll
2013-03-19 03:06:33 112640 ----a-w- C:\Windows\System32\smss.exe
2013-02-27 06:02:44 111448 ----a-w- C:\Windows\System32\consent.exe
2013-02-27 05:48:00 1930752 ----a-w- C:\Windows\System32\authui.dll
2013-02-27 05:47:10 70144 ----a-w- C:\Windows\System32\appinfo.dll
2013-02-27 04:49:24 1796096 ----a-w- C:\Windows\SysWow64\authui.dll
.
============= FINISH: 19:26:56.90 ===============

ATTACH
.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 05/01/2012 17:32:22
System Uptime: 23/05/2013 18:06:56 (1 hours ago)
.
Motherboard: TOSHIBA | | PWWAE
Processor: AMD Athlon(tm) II P360 Dual-Core Processor | Socket M2/S1G1 | 1679/200mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 74 GiB total, 22.606 GiB free.
D: is FIXED (NTFS) - 223 GiB total, 215.713 GiB free.
E: is CDROM ()
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP142: 21/05/2013 08:37:06 - avast! Free Antivirus Setup
RP143: 21/05/2013 10:22:30 - Windows Update
RP144: 21/05/2013 10:27:41 - Installed iTunes
RP145: 21/05/2013 10:42:09 - Installed Adobe Reader XI.
RP146: 21/05/2013 10:49:53 - avast! Free Antivirus Setup
RP147: 23/05/2013 18:03:56 - Installed Microsoft Visual C++ 2005 Redistributable
.
==== Installed Programs ======================
.
Adobe AIR
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Reader XI (11.0.03)
Advertising Center
ALTools Update
ALZip 8.51
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Ask Toolbar
ATI Catalyst Install Manager
avast! Free Antivirus
Bonjour
Catalyst Control Center - Branding
Catalyst Control Center Graphics Previews Common
Catalyst Control Center Graphics Previews Vista
Catalyst Control Center InstallProxy
Catalyst Control Center Localization All
ccc-core-static
ccc-utility64
CCC Help Chinese Standard
CCC Help Chinese Traditional
CCC Help Czech
CCC Help Danish
CCC Help Dutch
CCC Help English
CCC Help Finnish
CCC Help French
CCC Help German
CCC Help Greek
CCC Help Hungarian
CCC Help Italian
CCC Help Japanese
CCC Help Korean
CCC Help Norwegian
CCC Help Polish
CCC Help Portuguese
CCC Help Russian
CCC Help Spanish
CCC Help Swedish
CCC Help Thai
CCC Help Turkish
FastStone Image Viewer 4.7
FileHippo.com Update Checker
ImagXpress
iTunes
Java 7 Update 21 (64-bit)
Java Auto Updater
Java(TM) 6 Update 20
Malwarebytes Anti-Malware version 1.75.0.1300
Microsoft .NET Framework 4 Client Profile
Microsoft Mouse and Keyboard Center
Microsoft Office 2010
Microsoft Office Click-to-Run 2010
Microsoft Office Starter 2010 - English
Microsoft Silverlight
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Nero 9 Essentials
Nero BackItUp
Nero BackItUp and Burn
Nero BurnRights
Nero BurnRights Help
Nero ControlCenter
Nero DiscSpeed
Nero DiscSpeed Help
Nero DriveSpeed
Nero DriveSpeed Help
Nero Express
Nero Express Help
Nero InfoTool
Nero InfoTool Help
Nero Installer
Nero Online Upgrade
Nero RescueAgent
Nero StartSmart
Nero StartSmart Help
NeroExpress
neroxml
Opera 12.15
Photo Service - powered by myphotobook
PlayReady PC Runtime amd64
Realtek Ethernet Controller Driver For Windows 7
Realtek High Definition Audio Driver
Realtek USB 2.0 Card Reader
Realtek WLAN Driver
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Skype Click to Call
Skype� 6.3
Synaptics Pointing Device Driver
TeamViewer 7
TOSHIBA Assist
TOSHIBA Bulletin Board
TOSHIBA ConfigFree
TOSHIBA Disc Creator
TOSHIBA Face Recognition
TOSHIBA Flash Cards Support Utility
TOSHIBA Hardware Setup
TOSHIBA HDD/SSD Alert
Toshiba Manuals
TOSHIBA Media Controller
TOSHIBA Media Controller Plug-in
TOSHIBA Online Product Information
TOSHIBA Recovery Media Creator
TOSHIBA Recovery Media Creator Reminder
TOSHIBA ReelTime
TOSHIBA Service Station
TOSHIBA Supervisor Password
Toshiba TEMPRO
TOSHIBA Value Added Package
TOSHIBA Web Camera Application
TRORMCLauncher
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Utility Common Driver
Windows Live Sync
Windows Live Upload Tool
WinPatrol
Yontoo 2.04.1
.
==== Event Viewer Messages From Past Week ========
.
21/05/2013 16:40:45, Error: ACPI [13] - : The embedded controller (EC) did not respond within the specified timeout period. This may indicate that there is an error in the EC hardware or firmware or that the BIOS is accessing the EC incorrectly. You should check with your computer manufacturer for an upgraded BIOS. In some situations, this error may cause the computer to function incorrectly.
21/05/2013 12:40:52, Error: Service Control Manager [7022] - The Windows Update service hung on starting.
21/05/2013 10:27:36, Error: Service Control Manager [7031] - The Apple Mobile Device service terminated unexpectedly. It has done this 1 time(s). The following corrective action will be taken in 60000 milliseconds: Restart the service.
19/05/2013 08:54:14, Error: Microsoft-Windows-Bits-Client [16398] - A new BITS job could not be created. The current job count for the user Gubbins-TOSH\Gubbins (60) is equal to or greater than the job limit (60) specified through group policy. To correct the problem, complete or cancel the BITS jobs that haven't made progress by looking at the error, and restart the BITS service. If this error recurs, contact your system administrator and increate the per-user and per-computer Group Policy job limits.
.
==== End Of File ===========================

ARK
GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-23 19:41:17
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000005b TOSHIBA_ rev.GH10 298.09GB
Running: oqjelw3l.exe; Driver: C:\Users\Gubbins\AppData\Local\Temp\pxliapog.sys

---- Kernel code sections - GMER 2.1 ----

INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560 fffff80002df5000 13 bytes [D2, 48, 8B, CB, E8, DF, C2, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 574 fffff80002df500e 3 bytes [00, 00, 00]

---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\wininit.exe[516] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\services.exe[580] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\winlogon.exe[688] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[752] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\atiesrxx.exe[896] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[968] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\System32\svchost.exe[112] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[368] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[432] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1132] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\System32\spoolsv.exe[1504] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[1540] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1616] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1648] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Realtek\Realtek USB 2.0 Card Reader\RIconMan.exe[1736] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text c:\Program Files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe[1780] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe[2032] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe[1576] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files\TOSHIBA\Power Saver\TosCoSrv.exe[1060] C:\Windows\system32\kernel32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe[2148] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100181014
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100180804
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100180a08
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100180c0c
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100180e10
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001001801f8
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001001803fc
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2624] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100180600
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 00000001001c1014
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 00000001001c0804
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 00000001001c0a08
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 3 bytes JMP 00000001001c0c0c
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A + 4 0000000075eb54c6 1 byte [8A]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 00000001001c0e10
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001001c01f8
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001001c03fc
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 00000001001c0600
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001001d01f8
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001001d03fc
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 00000001001d0804
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 00000001001d0600
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2876] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 00000001001d0a08
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010018075c
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001001803a4
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100180b14
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100180ecc
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010018163c
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100181284
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001001819f4
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\svchost.exe[3004] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010042075c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001004203a4
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100420b14
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100420ecc
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010042163c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100421284
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001004219f4
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFIWmxSvcs64.exe[3400] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100240c0c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100240e10
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100261014
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100260804
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100260a08
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100260c0c
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100260e10
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001002601f8
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001002603fc
.text C:\Program Files (x86)\TOSHIBA\ConfigFree\CFSvcs.exe[3484] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100260600
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010021075c
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002103a4
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100210b14
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100210ecc
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010021163c
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100211284
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002119f4
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\System32\svchost.exe[3548] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3604] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010029075c
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002903a4
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100290b14
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100290ecc
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010029163c
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100291284
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002919f4
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\SearchIndexer.exe[3764] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010030075c
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003003a4
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100300b14
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100300ecc
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010030163c
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100301284
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003019f4
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\wbem\wmiprvse.exe[4048] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010016075c
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001001603a4
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100160b14
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100160ecc
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010016163c
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100161284
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001001619f4
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\taskhost.exe[1972] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010028075c
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002803a4
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100280b14
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100280ecc
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010028163c
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100281284
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002819f4
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\Dwm.exe[2924] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010025075c
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002503a4
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100250b14
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100250ecc
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010025163c
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100251284
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002519f4
.text C:\Windows\Explorer.EXE[2788] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\Explorer.EXE[2788] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001002b075c
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002b03a4
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001002b0b14
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001002b0ecc
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001002b163c
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001002b1284
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002b19f4
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\BulletinBoard\TosNcCore.exe[2704] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001002c075c
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002c03a4
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001002c0b14
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001002c0ecc
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001002c163c
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001002c1284
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002c19f4
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\ReelTime\TosReelTimeMonitor.exe[3176] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010032075c
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003203a4
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100320b14
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100320ecc
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010032163c
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100321284
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003219f4
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files (x86)\Toshiba TEMPRO\TemproTray.exe[2604] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010025075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002503a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100250b14
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100250ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010025163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100251284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002519f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[988] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001003c075c
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003c03a4
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001003c0b14
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001003c0ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001003c163c
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001003c1284
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003c19f4
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe[3432] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001003b075c
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003b03a4
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001003b0b14
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001003b0ecc
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001003b163c
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001003b1284
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003b19f4
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\Power Saver\TPwrMain.exe[2380] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\SmoothView\SmoothView.exe[1396] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001005f075c
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001005f03a4
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001005f0b14
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001005f0ecc
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001005f163c
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001005f1284
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001005f19f4
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\FlashCards\TCrdMain.exe[3820] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001003c075c
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003c03a4
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001003c0b14
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001003c0ecc
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001003c163c
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001003c1284
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003c19f4
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[3692] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010046075c
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001004603a4
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100460b14
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100460ecc
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010046163c
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100461284
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001004619f4
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\System32\svchost.exe[3780] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001001a075c
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001001a03a4
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001001a0b14
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001001a0ecc
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001001a163c
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001001a1284
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001001a19f4
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\Registration\ToshibaReminder.exe[3204] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010044075c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001004403a4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100440b14
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100440ecc
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010044163c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100441284
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001004419f4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe[2596] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010020075c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002003a4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100200b14
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100200ecc
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010020163c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100201284
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002019f4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe[3268] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000760f1465 2 bytes [0F, 76]
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760f14bb 2 bytes [0F, 76]
.text ... * 2
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001001401f8
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001001403fc
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 0000000100140804
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 0000000100140600
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 0000000100140a08
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100151014
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100150804
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100150a08
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100150c0c
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100150e10
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001001501f8
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001001503fc
.text C:\Program Files (x86)\BillP Studios\WinPatrol\WinPatrol.exe[3088] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100150600
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[3140] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001003c075c
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003c03a4
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001003c0b14
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001003c0ecc
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001003c163c
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001003c1284
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003c19f4
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files (x86)\FileHippo.com\UpdateChecker.exe[3960] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\Nero\Nero BackItUp & Burn\Nero BackItUp\NBAgent.exe[1232] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100250600
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001001e075c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001001e03a4
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001001e0b14
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001001e0ecc
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001001e163c
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001001e1284
.text C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe[3356] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001001e19f4
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001002401f8
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001002403fc
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 0000000100240804
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 0000000100240600
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 0000000100240a08
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100251014
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100250804
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100250a08
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100250c0c
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100250e10
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001002501f8
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001002503fc
.text C:\Program Files (x86)\TOSHIBA\Utilities\KeNotify.exe[2040] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100250600
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 00000001003a075c
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003a03a4
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 00000001003a0b14
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 00000001003a0ecc
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 00000001003a163c
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 00000001003a1284
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003a19f4
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\taskeng.exe[4108] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4448] C:\Windows\syswow64\kernel32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010033075c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001003303a4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100330b14
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100330ecc
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010033163c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100331284
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001003319f4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSmartSrv.exe[4992] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010026075c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001002603a4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100260b14
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100260ecc
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010026163c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100261284
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001002619f4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Program Files\TOSHIBA\TOSHIBA HDD SSD Alert\TosSENotify.exe[4856] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077343ae0 5 bytes JMP 000000010017075c
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077347a90 5 bytes JMP 00000001001703a4
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!NtAllocateVirtualMemory 0000000077371490 5 bytes JMP 0000000100170b14
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!NtFreeVirtualMemory 00000000773714f0 5 bytes JMP 0000000100170ecc
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!NtTerminateProcess 00000000773715d0 5 bytes JMP 000000010017163c
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!NtProtectVirtualMemory 0000000077371810 5 bytes JMP 0000000100171284
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000077372840 5 bytes JMP 00000001001719f4
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\system32\KERNEL32.dll!GetBinaryTypeW + 189 000000007725eecd 1 byte [62]
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!SetServiceObjectSecurity 000007fefee76e00 5 bytes JMP 000007ff7ee91dac
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigA 000007fefee76f2c 5 bytes JMP 000007ff7ee90ecc
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfigW 000007fefee77220 5 bytes JMP 000007ff7ee91284
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2A 000007fefee7739c 5 bytes JMP 000007ff7ee9163c
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!ChangeServiceConfig2W 000007fefee77538 5 bytes JMP 000007ff7ee919f4
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!CreateServiceA 000007fefee775e8 5 bytes JMP 000007ff7ee903a4
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!CreateServiceW 000007fefee7790c 5 bytes JMP 000007ff7ee9075c
.text C:\Windows\system32\taskhost.exe[3128] C:\Windows\SYSTEM32\sechost.dll!DeleteService 000007fefee77ab4 5 bytes JMP 000007ff7ee90b14
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!NtAllocateVirtualMemory 000000007751faa0 5 bytes JMP 0000000100030600
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!NtFreeVirtualMemory 000000007751fb38 5 bytes JMP 0000000100030804
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!NtTerminateProcess 000000007751fc90 5 bytes JMP 0000000100030c0c
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077520018 5 bytes JMP 0000000100030a08
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!NtSetContextThread 0000000077521900 5 bytes JMP 0000000100030e10
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 000000007753c45a 5 bytes JMP 00000001000301f8
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077541217 5 bytes JMP 00000001000303fc
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\KERNEL32.dll!GetBinaryTypeW + 112 00000000752ba30a 1 byte [62]
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!SetServiceObjectSecurity 0000000075eb5181 5 bytes JMP 0000000100241014
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigA 0000000075eb5254 5 bytes JMP 0000000100240804
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfigW 0000000075eb53d5 5 bytes JMP 0000000100240a08
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2A 0000000075eb54c2 5 bytes JMP 0000000100240c0c
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!ChangeServiceConfig2W 0000000075eb55e2 5 bytes JMP 0000000100240e10
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!CreateServiceA 0000000075eb567c 5 bytes JMP 00000001002401f8
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!CreateServiceW 0000000075eb589f 5 bytes JMP 00000001002403fc
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\SysWOW64\sechost.dll!DeleteService 0000000075eb5a22 5 bytes JMP 0000000100240600
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\USER32.dll!SetWinEventHook 0000000075a2ee09 5 bytes JMP 00000001002601f8
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\USER32.dll!UnhookWinEvent 0000000075a33982 5 bytes JMP 00000001002603fc
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\USER32.dll!SetWindowsHookExW 0000000075a37603 5 bytes JMP 0000000100260804
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\USER32.dll!SetWindowsHookExA 0000000075a3835c 5 bytes JMP 0000000100260600
.text C:\Users\Gubbins\Desktop\oqjelw3l.exe[4188] C:\Windows\syswow64\USER32.dll!UnhookWindowsHookEx 0000000075a4f52b 5 bytes JMP 0000000100260a08

---- Threads - GMER 2.1 ----

Thread C:\Windows\system32\svchost.exe [1540:1712] 000007fef30b2888
Thread C:\Windows\system32\svchost.exe [1540:2636] 000007fef30b2a40
Thread C:\Windows\System32\svchost.exe [3548:3980] 000007fef5b79688
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:3648] 000007fefd9a0168
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:3680] 000007fefb7f2a7c
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:3688] 000007fef621d618
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:3956] 000007fef9555124
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:4032] 000007fef61b9730
Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3604:4036] 000007fef621d618

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswFsBlk
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswMonFlt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll, bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRdr
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@BootCounter 9
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@TickCounter 108477
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswRvrt
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Type 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSnx
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\CurrentControlSet\services\aswSP
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Start 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi@Tag 10
Reg HKLM\SYSTEM\CurrentControlSet\services\aswTdi
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Type 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Start 0
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm\Parameters
Reg HKLM\SYSTEM\CurrentControlSet\services\aswVmm
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus@Description Manages and implements avast! antivirus services for this computer. This includes the resident protection, the virus chest and the scheduler.
Reg HKLM\SYSTEM\CurrentControlSet\services\avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DisplayName aswFsBlk
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Group FSFilter Activity Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Description avast! mini-filter driver (aswFsBlk)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances@DefaultInstance aswFsBlk Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Altitude 388400
Reg HKLM\SYSTEM\ControlSet002\services\aswFsBlk\Instances\aswFsBlk Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@ImagePath \??\C:\Windows\system32\drivers\aswMonFlt.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DisplayName aswMonFlt
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Group FSFilter Anti-Virus
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt@Description avast! mini-filter driver (aswMonFlt)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances@DefaultInstance aswMonFlt Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Altitude 320700
Reg HKLM\SYSTEM\ControlSet002\services\aswMonFlt\Instances\aswMonFlt Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DisplayName aswRdr
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@Description avast! WFP Redirect driver
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr@ImagePath \SystemRoot\System32\Drivers\aswrdr2.sys
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@MSIgnoreLSPDefault
Reg HKLM\SYSTEM\ControlSet002\services\aswRdr\Parameters@WSIgnoreLSPDefault nl_lsp.dll,imon.dll,xfire_lsp.dll,mslsp.dll,mssplsp.dll,cwhook.dll,spi.dll, bmnet.dll,winsflt.dll
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@DisplayName aswRvrt
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt@Description avast! Revert
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@BootCounter 9
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@TickCounter 108477
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@SystemRoot \Device\Harddisk0\Partition2\Windows
Reg HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters@ImproperShutdown 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Type 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DisplayName aswSnx
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Group FSFilter Virtualization
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@DependOnService FltMgr?
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Description avast! virtualization driver (aswSnx)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx@Tag 2
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances@DefaultInstance aswSnx Instance
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Altitude 137600
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Instances\aswSnx Instance@Flags 0
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSnx\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@DisplayName aswSP
Reg HKLM\SYSTEM\ControlSet002\services\aswSP@Description avast! Self Protection
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@BehavShield 1
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFolder \DosDevices\C:\Program Files\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@DataFolder \DosDevices\C:\ProgramData\AVAST Software\Avast
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@ProgramFilesFolder \DosDevices\C:\Program Files
Reg HKLM\SYSTEM\ControlSet002\services\aswSP\Parameters@GadgetFolder \DosDevices\C:\Program Files\Windows Sidebar\Shared Gadgets\aswSidebar.gadget
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Start 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DisplayName avast! Network Shield Support
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Group PNP_TDI
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@DependOnService tcpip?
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Description avast! Network Shield TDI driver
Reg HKLM\SYSTEM\ControlSet002\services\aswTdi@Tag 10
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Type 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Start 0
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@DisplayName aswVmm
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm@Description avast! VM Monitor
Reg HKLM\SYSTEM\ControlSet002\services\aswVmm\Parameters (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Type 32
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Start 2
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ErrorControl 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ImagePath "C:\Program Files\AVAST Software\Avast\AvastSvc.exe"
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DisplayName avast! Antivirus
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Group ShellSvcGroup
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@DependOnService aswMonFlt?RpcSS?
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@WOW64 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ObjectName LocalSystem
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@ServiceSidType 1
Reg HKLM\SYSTEM\ControlSet002\services\avast! Antivirus@Description Manages and implements avast! antivirus services for this computer. This includes the resident protection, the virus chest and the scheduler.

---- EOF - GMER 2.1 ----

Many thanks,
Gubbo

[file name]contained a virus and was deleted"

dfloyd_chef — Thu, 23 May 2013 18:44:47 GMT

I have a two computer network protected by a Sonicwall firewall. About a week ago I was on the internet and a virus warning popped up from my then installed security software Zone Alarm. Afterwards, my connection to the internet was lost but on one machine only. After much work, I restored internet access but had to delete Zone Alarm. From the time I restored internet access I have not been able to download ANY file without getting the message: "[file name] contained a virus and was deleted". In addition to IE9 that I normally use, I tried Firefox and Chrome with the same results. I've explored the options for security settings and have tried them all, but since ALL browsers are affected, I suspect a virus. I tried to reinstall Zone Alarm, but it immediately stopped my internet access again, so I uninstalled it. Note TSG still thinks it's installed.

OS Version: Microsoft Windows 7 Professional, Service Pack 1, 32 bit
Processor: Pentium(R) Dual-Core CPU E6700 @ 3.20GHz, x64 Family 6 Model 23 Stepping 10
Processor Count: 2
RAM: 3293 Mb
Graphics Card: Intel(R) G41 Express Chipset, 1422 Mb
Hard Drives: C: Total - 476837 MB, Free - 442073 MB;
Motherboard: MSI, G41M4 (MS-7592)
Antivirus: ZoneAlarm Antivirus, Updated and Enabled

Outlook 2007 message: offline folder file cannot be configured

SmallBizBoss — Thu, 23 May 2013 18:29:06 GMT

The day after my latest Win 7 Update, I suddenly started getting the error message:

MICROSOFT OFFICE OUTLOOK OFFLINE FOLDERS:
Your offline folder file cannot be configured.

c:\Users\Scott\AppData\Local\Microsoft\Outlook\outlook.ost

Besides this message, my emails struggle to open, I cannot attach files to outgoing emails, etc. I tried the Recovery function, to take my laptop to a date prior to the Windows Update I did on 5/21, but it couldn't execute for that date, or for prior dates (which may be another separate problem to deal with). I don't know what to do, other than possibly reinstall Office. Advice?

Windows startup failure

J3deff — Thu, 23 May 2013 18:08:45 GMT

I have an ASUS K60IJ laptop in which Windows 7 will start on battery, but not with the charger plugged in. If the charger is plugged in, it will cause the computer to reboot continously. I have tried a new charger with the same results so it is not the charger. The computer will run in BIOS boot with battery and charger connected. But if the charger remains connected during windows startup, it will reboot. I have tried with the battery removed from the computer with the same results. I have run PC cleaner software and Norton 360 without solving the problem. Since the computer will run in BIOS with the charger connected, I am thinking it is a startup virus. I would like to know if others have similar problems with possible solutions.

Program Won't Install

Robert the Bruce — Thu, 23 May 2013 18:06:36 GMT

I'm trying to install a program. I go to 'My Documents' then 'Downloads' which is the name of the folder where the set-up icon is. I click on the icon and then click 'Run' as you normally would. But after I select the language (English) a message window appears which says 'Set-Up has detected that this program is already running, Please close all applications and continue.' I don't understand, how can this program be running if I haven't even installed it ? Although I do have a program from the same Software Company which had been 'locking' earlier. But as far as I can see, it's not running. So why would I get this message, if it's not running ?

Inherited speakers compatible?

Psycher — Thu, 23 May 2013 17:50:34 GMT

I recently came by a pair of what I now know to be very decent speakers.
They are part of this unit:
http://www.amazon.com/Panasonic-SC-A...pr_product_top
Only the speakers, however.
They are bi-wired, with both wirings rated at 140W @ 6 ohm.

Now I also have a decent system already.
http://www.overstock.com/Electronics...2/product.html
They are only 15W, mono-wired, and 8 ohm.. I'm quite happy with it already but now that I have these much larger speakers I'd like to know if I'd get any benefit from plugging them into this unit.

From what I've read, the Bi-wiring is a joke. Will merging the two '+' and the two '-' cables together cause any harm? (they already are on the unit, can undo if recommended)

Next, do I have any real cause for concern with my output being 8ohm and speakers being much higher wattage @ only 6 ohm?

Finally, would it help at all anyway? There doesn't seem to be a market for amplifier units like this. I'm either dumb or there aren't replacement units or anything that could take it's place?

Security Centre

Climewoman — Thu, 23 May 2013 17:42:20 GMT

We're Sorry, The Security Centre could not change your Automatic Updates Centre.

This is the error message that I receive. My automatic updates is turned on, but the balloon is red in my icon tray.
Does this mean I am not secured for updates, or should I just ignore it.

Any and all help is greatly appreciated.

i have dell (inspiron m5030) laptop

thelionn — Thu, 23 May 2013 17:34:25 GMT

hi all
i have dell (inspiron M5030) laptop and i have a built-in camera and i want it driver

however i went to dell website looking for the driver but i didn't know what's my camera's driver they gave me this list:
Application (3)
Audio (1)
BIOS (1)
Chipset (2)
Communications (4)
Diagnostics (1)
Drivers for OS Deployment (2)
Input (1)
Network (4)
Removable Storage (2)
Serial ATA (3)
System Utilities (1)
Video (1)

and i didn't know which one is for the camera :( i know it is funny but i couldn't know

so i need your help guys

thank you

GPS Tracking App for Android Phone

tnt717 — Thu, 23 May 2013 17:32:19 GMT

Is there a better app out there than Google's Latitude program for keeping track of where you have been on your Android phone. My company pays me mileage but they want fairly precise information on the distances between stops. I have a lot of short trips between clients and would like to find something that keeps something of a log. I feel like i am losing out on a lot of reimbursement dollars because Latitude is not only imprecise but about twice a day puts me somewhere miles from where I actually was. There is no secrecy involved here (my wife doesn't really care where I'm at) so accuracy is the most important aspect.

I'd really appreciate any help.

Thanks...

.exe is not a valid win32 application

shamalama — Thu, 23 May 2013 17:31:38 GMT

Tech Support Guy System Info Utility version 1.0.0.2
OS Version: Microsoft Windows XP Professional, Service Pack 2, 32 bit
Processor: Intel(R) Pentium(R) M processor 1500MHz, x86 Family 6 Model 9 Stepping 5
Processor Count: 1
RAM: 511 Mb
Graphics Card: MOBILITY RADEON 9200, 64 Mb
Hard Drives: C: Total - 38146 MB, Free - 19704 MB;
Motherboard: COMPAL, 0860
Antivirus: avast! Antivirus, Updated: Yes, On-Demand Scanner: Enabled

The error message '.exe is not a valid win32 application' keeps popping up when ever I try to run a download for example like itunes or when I try to download windows components. I do not have any service packs or compression clients as it won't allow me either. I have recently had it's hard drive wiped due to hard drive corruption. I think it may be that I may have missing components but I am not sure which.

juno

lilaco — Thu, 23 May 2013 17:24:51 GMT

using windows 7
when i'm sending mail the default setting is "to"
I want to change it so that the default setting is "bcc"
also the default setting for the font is "12"
I want to change it to "14"

HELP!!!!!!!!!!!!!!!!!!!

herb

Water Drops on Flowers

Guyzer — Thu, 23 May 2013 17:23:09 GMT

We had a hard rain last night so I decided to fire off a few early this morning just for the heck of it.

Thanks for looking...

HP Pavilion a6110n Desktop

roosterwes — Thu, 23 May 2013 17:21:13 GMT

ASUS M2N68-LA (Narra2) motherboard
Anyone familiar with this model and know the best way to reset the bios? I have moved the jumper, taken out the battery and unplugged it many times. It works, but I have to wait a while. The reset button looks bent, and Im scared it will break off(from experience). The problem is, I get it reset, and make my changes in the bios, and it only boots into (what i call)standby mode. The fan runs, but no video. I have taken out the new vid card. This happened when the power cut off. Its happened before to this machine and others with Asus boards that Ive had here. Its just always a major pain to get everything back on and get video back up. It has a good power supply, and not the Bestec one that came with it. Is there a trick here I dont know? Thanks in advance

no sound

dbruner66 — Thu, 23 May 2013 17:07:33 GMT

why am i not getting sound on my computer

fan running with lid closed, but blank screen when lid opened

cjotjr25 — Thu, 23 May 2013 16:52:54 GMT

I have a Toshiba Satellite P745. When I close the lid the fan stays on and so does the light for the power button, then when I open the lid the screen stays blank and the computer doesn't start. I have to then manually power it down and it then works fine. Some other information when the laptop first starts it asks me if i want to use windows 7 or perform a system restore, then the screen that tells you your computer didn't shut down right (the screen that gives you the option to run in safe mode) and then it starts fine. It also once in awhile makes a weird clicking noise in the bottom right corner. I have tried taking out the battery and that didn't work.
Thanks for the help