1. Computer problem? Tech Support Guy is completely free -- paid for by advertisers and donations. Click here to join today! If you're new to Tech Support Guy, we highly recommend that you visit our Guide for New Members.

Multiple instances of iexplorer.exe and cannot connect to internet

Discussion in 'Virus & Other Malware Removal' started by wausau99, Jan 16, 2011.

Thread Status:
Not open for further replies.
Advertisement
  1. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    Hello everyone,

    Recently, I have been having an issue with my computer connecting to the internet using IE8. After a restart of the computer, I am able to connect to the internet, but if I close the browser and try to log in later I am not able to get to the internet.

    Today, while trying to figure this out I noticed that I have multiple instances of iexplorer listed in Task Manager even when IE is not open.

    Hoping someone could be of assistance. Here are the logs that are requested. I have the Attach.txt log but have been unable to attach it to this post.

    HijackThis Log

    Logfile of Trend Micro HijackThis v2.0.4
    Scan saved at 4:14:23 PM, on 1/16/2011
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18702)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe
    C:\Program Files\Charter Security Suite\Common\FSMA32.EXE
    C:\Program Files\Charter Security Suite\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Charter Security Suite\Common\FSHDLL32.EXE
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\Charter Security Suite\Common\FSM32.EXE
    C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\hphmon06.exe
    C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe
    C:\WINDOWS\system32\taskswitch.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\desktop weather\desktopweather_1219728.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Charter Security Suite\Anti-Virus\fssm32.exe
    C:\Program Files\Charter Security Suite\FWES\Program\fsdfwd.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\dlcccoms.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Charter Security Suite\Anti-Virus\fsav32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Steve\Desktop\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: AcroIEHelperStub - Disabled:{18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
    O2 - BHO: Search Helper - Disabled:{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - (no file)
    O2 - BHO: (no name) - Disabled:{9030D464-4C02-4ABF-8ECC-5164760863C6} - (no file)
    O2 - BHO: (no name) - Disabled:{AA58ED58-01DD-4d91-8333-CF10577473F7} - (no file)
    O2 - BHO: (no name) - Disabled:{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
    O2 - BHO: LitmusBHO - Disabled:{C6867EB7-8350-4856-877F-93CF8AE3DC9C} - (no file)
    O2 - BHO: Ask Toolbar BHO - Disabled:{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
    O2 - BHO: (no name) - Disabled:{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - (no file)
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.6.5805.1910\swg.dll
    O2 - BHO: Bing Bar BHO - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
    O3 - Toolbar: Browsing Protection Toolbar - {265EEE8E-3228-44D3-AEA5-F7FDF5860049} - C:\Program Files\Charter Security Suite\NRS\iescript\baselitmus.dll
    O3 - Toolbar: Ask Toolbar - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files\Ask.com\GenericAskToolbar.dll
    O3 - Toolbar: @C:\Program Files\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll,-100 - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\MSN Toolbar\Platform\6.3.2348.0\npwinext.dll
    O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [PDVDDXSrv] "C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe"
    O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatchTray10.exe"
    O4 - HKLM\..\Run: [F-Secure Manager] "C:\Program Files\Charter Security Suite\Common\FSM32.EXE" /splash
    O4 - HKLM\..\Run: [F-Secure TNB] "C:\Program Files\Charter Security Suite\FSGUI\TNBUtil.exe" /CHECKALL /WAITFORSW
    O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,[email protected]
    O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"
    O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe
    O4 - HKLM\..\Run: [HPHUPD06] C:\Program Files\HP\{BA2D9411-DBB4-43e4-9421-780413650A67}\hphupd06.exe
    O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
    O4 - HKLM\..\Run: [HPHmon06] C:\WINDOWS\system32\hphmon06.exe
    O4 - HKLM\..\Run: [HPHped06] C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe
    O4 - HKLM\..\Run: [CoolSwitch] C:\WINDOWS\system32\taskswitch.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Microsoft Default Manager] "C:\Program Files\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume
    O4 - HKLM\..\Run: [ArcSoft Connection Service] C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    O4 - HKCU\..\Run: [swg] "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: desktop weather.lnk = C:\Program Files\desktop weather\desktopweather_1219728.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    O4 - Global Startup: taskmgr.lnk = C:\WINDOWS\system32\taskmgr.exe
    O4 - Global Startup: WDDMStatus.lnk = C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    O4 - Global Startup: WDSmartWare.lnk = C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    O4 - Global Startup: Windows Search.lnk = C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
    O9 - Extra button: Blog This - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra 'Tools' menuitem: &Blog This in Windows Live Writer - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files\Windows Live\Writer\WriterBrowserExtension.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.clonewarsadventures.com
    O15 - Trusted Zone: *.freerealms.com
    O15 - Trusted Zone: *.soe.com
    O15 - Trusted Zone: *.sony.com
    O16 - DPF: Garmin Communicator Plug-In - https://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
    O16 - DPF: {000F1EA4-5E08-4564-A29B-29076F63A37A} (SOE Web Installer) - http://launch.soe.com/plugin/web/SOEWebInstaller.cab
    O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - https://support.dell.com/systemprofiler/SysPro.CAB
    O16 - DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} (Scanner.SysScanner) - http://i.dell.com/images/global/js/scanner/SysProExe.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/mic...ls/en/x86/client/muweb_site.cab?1272159645750
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    O20 - Winlogon Notify: GoToAssist - C:\Program Files\Citrix\GoToAssist\514\G2AWinLogon.dll
    O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
    O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
    O23 - Service: ArcSoft Connect Daemon (ACDaemon) - ArcSoft Inc. - C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: dlcc_device - Unknown owner - C:\WINDOWS\system32\dlcccoms.exe
    O23 - Service: FSGKHS (F-Secure Gatekeeper Handler Starter) - Unknown owner - C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe
    O23 - Service: F-Secure Anti-Virus Firewall Daemon (FSDFWD) - F-Secure Corporation - C:\Program Files\Charter Security Suite\FWES\Program\fsdfwd.exe
    O23 - Service: F-Secure Management Agent (FSMA) - F-Secure Corporation - C:\Program Files\Charter Security Suite\Common\FSMA32.EXE
    O23 - Service: F-Secure ORSP Client (FSORSPClient) - F-Secure Corporation - C:\Program Files\Charter Security Suite\ORSP Client\fsorsp.exe
    O23 - Service: GoToAssist - Citrix Online, a division of Citrix Systems, Inc. - C:\Program Files\Citrix\GoToAssist\514\g2aservice.exe
    O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
    O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: Intuit Update Service (IntuitUpdateService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LiveShare P2P Server 10 (RoxLiveShare10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxLiveShare10.exe
    O23 - Service: RoxMediaDB10 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxMediaDB10.exe
    O23 - Service: Roxio Hard Drive Watcher 10 (RoxWatch10) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\10.0\SharedCOM\RoxWatch10.exe
    O23 - Service: SessionLauncher - Unknown owner - C:\DOCUME~1\Steve\LOCALS~1\Temp\DX9\SessionLauncher.exe (file missing)
    O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
    O23 - Service: WD SmartWare Drive Manager (WDDMService) - WDC - C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    O23 - Service: WD SmartWare Background Service (WDSmartWareBackgroundService) - Memeo - C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    O23 - Service: WMP54Gv4SVC - GEMTEKS - C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe

    --
    End of file - 15126 bytes


    DDS.txt Log


    DDS (Ver_10-12-12.02) - NTFSx86
    Run by Steve at 16:15:23.89 on Sun 01/16/2011
    Internet Explorer: 8.0.6001.18702
    Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1022.394 [GMT -6:00]

    AV: Charter Security Suite 9.01 *Disabled/Updated* {E7512ED5-4245-4B4D-AF3A-382D3F313F15}
    FW: Charter Security Suite 9.01 *Disabled*

    ============== Running Processes ===============

    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    svchost.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Charter Security Suite\Anti-Virus\fsgk32st.exe
    C:\Program Files\Charter Security Suite\Common\FSMA32.EXE
    C:\Program Files\Charter Security Suite\Anti-Virus\FSGK32.EXE
    C:\Program Files\Common Files\Intuit\Update Service\IntuitUpdateService.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\ehome\ehtray.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe
    C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe
    C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINDOWS\system32\hphmon06.exe
    C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe
    C:\WINDOWS\system32\taskswitch.exe
    C:\Program Files\Common Files\Java\Java Update\jusched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\HP\digital imaging\bin\hpqtra08.exe
    C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWare.exe
    C:\Program Files\Windows Desktop Search\WindowsSearch.exe
    C:\Program Files\desktop weather\desktopweather_1219728.exe
    C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
    svchost.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe
    C:\Program Files\Western Digital\WD SmartWare\Front Parlor\WDSmartWareBackgroundService.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe
    C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe
    C:\WINDOWS\system32\SearchIndexer.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
    C:\Program Files\Charter Security Suite\Anti-Virus\fssm32.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\dlcccoms.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\WINDOWS\system32\SearchProtocolHost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Charter Security Suite\Common\FSLAUNCH.EXE
    C:\Documents and Settings\Steve\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uStart Page = hxxp://www.google.com/webhp?sourceid=navclient&ie=UTF-8
    uInternet Settings,ProxyOverride = *.local
    BHO: Disabled:{18DF081C-E8AD-4283-A596-FA578C2EBDC3} - No File
    BHO: Disabled:{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - No File
    BHO: Disabled:{9030D464-4C02-4ABF-8ECC-5164760863C6} - No File
    BHO: Disabled:{AA58ED58-01DD-4d91-8333-CF10577473F7} - No File
    BHO: Disabled:{AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - No File
    BHO: Disabled:{C6867EB7-8350-4856-877F-93CF8AE3DC9C} - No File
    BHO: Disabled:{D4027C7F-154A-4066-A1AD-4243D8127440} - No File
    BHO: Disabled:{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - No File
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SEPsearchhelperie.dll
    BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.6.5805.1910\swg.dll
    BHO: Bing Bar BHO: {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - c:\program files\msn toolbar\platform\6.3.2348.0\npwinext.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
    TB: Browsing Protection Toolbar: {265eee8e-3228-44d3-aea5-f7fdf5860049} - c:\program files\charter security suite\nrs\iescript\baselitmus.dll
    TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll
    TB: @c:\program files\msn toolbar\platform\6.3.2348.0\npwinext.dll,-100: {8dcb7100-df86-4384-8842-8fa844297b3f} - c:\program files\msn toolbar\platform\6.3.2348.0\npwinext.dll
    TB: Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar_32.dll
    uRun: [swg] "c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe"
    uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [SigmatelSysTrayApp] stsystra.exe
    mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe
    mRun: [PDVDDXSrv] "c:\program files\cyberlink\powerdvd dx\PDVDDXSrv.exe"
    mRun: [RoxWatchTray] "c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatchTray10.exe"
    mRun: [F-Secure Manager] "c:\program files\charter security suite\common\FSM32.EXE" /splash
    mRun: [F-Secure TNB] "c:\program files\charter security suite\fsgui\TNBUtil.exe" /CHECKALL /WAITFORSW
    mRun: [DLCCCATS] rundll32 c:\windows\system32\spool\drivers\w32x86\3\DLCCtime.dll,[email protected]
    mRun: [dlccmon.exe] "c:\program files\dell photo aio printer 924\dlccmon.exe"
    mRun: [HPDJ Taskbar Utility] c:\windows\system32\spool\drivers\w32x86\3\hpztsb13.exe
    mRun: [HPHUPD06] c:\program files\hp\{ba2d9411-dbb4-43e4-9421-780413650a67}\hphupd06.exe
    mRun: [HP Software Update] "c:\program files\hp\hp software update\HPWuSchd2.exe"
    mRun: [HPHmon06] c:\windows\system32\hphmon06.exe
    mRun: [HPHped06] c:\progra~1\hp\{ba2d9~1\pexpress\hphPED06.exe
    mRun: [CoolSwitch] c:\windows\system32\taskswitch.exe
    mRun: [SunJavaUpdateSched] "c:\program files\common files\java\java update\jusched.exe"
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe"
    mRun: [Adobe ARM] "c:\program files\common files\adobe\arm\1.0\AdobeARM.exe"
    mRun: [QuickTime Task] "c:\program files\quicktime\qttask.exe" -atboottime
    mRun: [AppleSyncNotifier] c:\program files\common files\apple\mobile device support\AppleSyncNotifier.exe
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe"
    mRun: [Microsoft Default Manager] "c:\program files\microsoft\search enhancement pack\default manager\DefMgr.exe" -resume
    mRun: [ArcSoft Connection Service] c:\program files\common files\arcsoft\connection service\bin\ACDaemon.exe
    StartupFolder: c:\docume~1\steve\startm~1\programs\startup\deskto~1.lnk - c:\program files\desktop weather\desktopweather_1219728.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\kodake~1.lnk - c:\program files\kodak\kodak easyshare software\bin\EasyShare.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\taskmgr.lnk - c:\windows\system32\taskmgr.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wddmst~1.lnk - c:\program files\western digital\wd smartware\wd drive manager\WDDMStatus.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\wdsmar~1.lnk - c:\program files\western digital\wd smartware\front parlor\WDSmartWare.exe
    StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\window~1.lnk - c:\program files\windows desktop search\WindowsSearch.exe
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000
    IE: Google Sidewiki... - c:\program files\google\google toolbar\component\GoogleToolbarDynamic_mui_en_E11712C84EA7E12B.dll/cmsidewiki.html
    IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL
    LSP: c:\program files\charter security suite\fsps\program\FSLSP.DLL
    Trusted Zone: clonewarsadventures.com
    Trusted Zone: freerealms.com
    Trusted Zone: intuit.com\ttlc
    Trusted Zone: soe.com
    Trusted Zone: sony.com
    DPF: Garmin Communicator Plug-In - hxxps://static.garmincdn.com/gcp/ie/2.9.2.0/GarminAxControl.CAB
    DPF: {000F1EA4-5E08-4564-A29B-29076F63A37A} - hxxp://launch.soe.com/plugin/web/SOEWebInstaller.cab
    DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} - hxxps://support.dell.com/systemprofiler/SysPro.CAB
    DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {233C1507-6A77-46A4-9443-F871F945D258} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
    DPF: {362C56AA-6E4F-40C7-A0B5-85501DBDAD77} - hxxp://i.dell.com/images/global/js/scanner/SysProExe.cab
    DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1272159645750
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
    DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
    Notify: GoToAssist - c:\program files\citrix\gotoassist\514\G2AWinLogon.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll
    SEH: Windows Desktop Search Namespace Manager: {56f9679e-7826-4c84-81f3-532071a8bcc5} - c:\program files\windows desktop search\MSNLNamespaceMgr.dll
    Hosts: 127.0.0.1 www.spywareinfo.com

    ================= FIREFOX ===================

    FF - ProfilePath - c:\docume~1\steve\applic~1\mozilla\firefox\profiles\kwvvwaiq.default\
    FF - prefs.js: browser.search.defaulturl - hxxp://www.bing.com/search?FORM=MSNTLB&PC=MSNTDF&q=
    FF - prefs.js: keyword.URL - hxxp://www.bing.com/search?FORM=MSNTLB&PC=MSNTDF&q=
    FF - prefs.js: network.proxy.type - 0
    FF - component: c:\program files\charter security suite\nrs\[email protected]\components\litmus-ff.dll
    FF - plugin: c:\program files\google\update\1.2.183.39\npGoogleOneClick8.dll
    FF - plugin: c:\program files\java\jre6\bin\new_plugin\npdeployJava1.dll
    FF - plugin: c:\program files\microsoft\office live\npOLW.dll
    FF - plugin: c:\program files\unity\webplayer\loader\npUnity3D32.dll
    FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
    FF - plugin: c:\windows\downloaded program files\npsoe.dll
    FF - Ext: Default: {972ce4c6-7e08-4474-a285-3208198ce6fd} - c:\program files\mozilla firefox\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
    FF - Ext: Browsing Protection: [email protected] - c:\program files\charter security suite\nrs\[email protected]
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\microsoft.net\framework\v3.5\windows presentation foundation\DotNetAssistantExtension
    FF - Ext: Java Quick Starter: [email protected] - c:\program files\java\jre6\lib\deploy\jqs\ff
    FF - Ext: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - %profile%\extensions\{20a82645-c095-46ed-80e3-08825760534b}

    ============= SERVICES / DRIVERS ===============

    R0 fsbts;fsbts;c:\windows\system32\drivers\fsbts.sys [2010-4-24 42664]
    R0 FSFW;F-Secure Firewall Driver;c:\windows\system32\drivers\fsdfw.sys [2010-4-24 82120]
    R1 F-Secure HIPS;F-Secure HIPS Driver;c:\program files\charter security suite\hips\drivers\fshs.sys [2010-4-24 68064]
    R2 F-Secure Gatekeeper Handler Starter;FSGKHS;c:\program files\charter security suite\anti-virus\fsgk32st.exe [2010-4-24 215648]
    R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr_tdi.sys [2010-4-24 54752]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 WDDMService;WD SmartWare Drive Manager;c:\program files\western digital\wd smartware\wd drive manager\WDDMService.exe [2010-1-21 110592]
    R2 WDSmartWareBackgroundService;WD SmartWare Background Service;c:\program files\western digital\wd smartware\front parlor\WDSmartWareBackgroundService.exe [2009-6-16 20480]
    R3 F-Secure Gatekeeper;F-Secure Gatekeeper;c:\program files\charter security suite\anti-virus\minifilter\fsgk.sys [2010-4-24 130728]
    R3 WDC_SAM;WD SCSI Pass Thru driver;c:\windows\system32\drivers\wdcsam.sys [2010-4-24 11520]
    S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\microsoft.net\framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
    S2 gupdate;Google Update Service (gupdate);c:\program files\google\update\GoogleUpdate.exe [2010-5-8 135664]
    S2 RoxLiveShare10;LiveShare P2P Server 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxLiveShare10.exe [2008-5-14 309744]
    S2 RoxWatch10;Roxio Hard Drive Watcher 10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxWatch10.exe [2008-5-14 166384]
    S2 SessionLauncher;SessionLauncher;c:\docume~1\steve\locals~1\temp\dx9\sessionlauncher.exe --> c:\docume~1\steve\locals~1\temp\dx9\SessionLauncher.exe [?]
    S3 FSORSPClient;F-Secure ORSP Client;c:\program files\charter security suite\orsp client\fsorsp.exe [2010-4-24 63992]
    S3 fsssvc;Windows Live Family Safety Service;c:\program files\windows live\family safety\fsssvc.exe [2009-8-5 704864]
    S3 RoxMediaDB10;RoxMediaDB10;c:\program files\common files\roxio shared\10.0\sharedcom\RoxMediaDB10.exe [2008-5-14 1120752]
    S3 WinRM;Windows Remote Management (WS-Management);c:\windows\system32\svchost.exe -k WINRM [2004-8-10 14336]
    S3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\microsoft.net\framework\v4.0.30319\wpf\WPFFontCache_v0400.exe [2010-3-18 753504]
    S4 F-Secure Filter;F-Secure File System Filter;c:\program files\charter security suite\anti-virus\win2k\fsfilter.sys [2010-4-24 39776]
    S4 F-Secure Recognizer;F-Secure File System Recognizer;c:\program files\charter security suite\anti-virus\win2k\fsrec.sys [2010-4-24 25184]

    =============== Created Last 30 ================

    2011-01-12 01:55:27 -------- d-----w- c:\windows\system32\wbem\repository\FS
    2011-01-12 01:55:27 -------- d-----w- c:\windows\system32\wbem\Repository
    2011-01-06 22:47:07 -------- d-----w- c:\docume~1\steve\locals~1\applic~1\Intuit
    2011-01-06 22:46:35 -------- d-----w- c:\docume~1\steve\applic~1\Intuit
    2011-01-06 22:40:50 -------- d-----w- c:\docume~1\steve\locals~1\applic~1\IsolatedStorage
    2011-01-06 22:40:47 -------- d-----w- c:\program files\common files\Intuit
    2011-01-06 22:40:14 -------- d-----w- c:\program files\TurboTax
    2011-01-06 22:39:28 -------- d-----w- c:\docume~1\alluse~1\applic~1\Intuit
    2010-12-31 04:09:05 1790635 ----a-w- c:\documents and settings\all users\SPL287.tmp
    2010-12-28 13:53:09 4448708 ----a-w- c:\documents and settings\all users\SPL1B7.tmp
    2010-12-26 15:34:22 7340 ----a-w- c:\windows\system32\PerfStringBackup.TMP
    2010-12-20 00:07:12 -------- d-----w- c:\docume~1\steve\locals~1\applic~1\KodakGallery
    2010-12-20 00:05:29 -------- d-----w- c:\docume~1\steve\applic~1\Skinux
    2010-12-20 00:02:07 -------- d-----w- c:\docume~1\steve\locals~1\applic~1\ArcSoft
    2010-12-20 00:01:53 -------- d-----w- c:\docume~1\alluse~1\applic~1\ArcSoft
    2010-12-19 23:58:46 -------- d-----w- c:\program files\common files\Kodak
    2010-12-19 23:57:39 62976 -c----w- c:\windows\system32\dllcache\cdrom.sys
    2010-12-19 23:57:38 465920 -c----w- c:\windows\system32\dllcache\imapi2fs.dll
    2010-12-19 23:57:38 465920 ------w- c:\windows\system32\imapi2fs.dll
    2010-12-19 23:57:38 317952 -c----w- c:\windows\system32\dllcache\imapi2.dll
    2010-12-19 23:57:38 317952 ------w- c:\windows\system32\imapi2.dll
    2010-12-19 23:57:34 -------- d-----w- c:\program files\Kodak
    2010-12-19 23:54:55 -------- d-----w- c:\docume~1\alluse~1\applic~1\Kodak
    2010-12-19 20:58:27 -------- d-----w- c:\docume~1\steve\locals~1\applic~1\SCE
    2010-12-19 20:55:00 -------- d-----w- c:\program files\Sony Online Entertainment
    2010-12-19 20:54:58 -------- d-----w- c:\docume~1\steve\applic~1\Sony Online Entertainment

    ==================== Find3M ====================

    2010-11-18 18:12:44 81920 ----a-w- c:\windows\system32\isign32.dll
    2010-11-09 14:52:35 249856 ----a-w- c:\windows\system32\odbc32.dll
    2010-11-06 00:26:58 916480 ----a-w- c:\windows\system32\wininet.dll
    2010-11-06 00:26:58 43520 ----a-w- c:\windows\system32\licmgr10.dll
    2010-11-06 00:26:58 1469440 ------w- c:\windows\system32\inetcpl.cpl
    2010-11-03 12:25:54 385024 ----a-w- c:\windows\system32\html.iec
    2010-11-02 20:52:22 1716297 ----a-w- c:\windows\system32\InetClnt.dll
    2010-10-28 13:13:22 290048 ----a-w- c:\windows\system32\atmfd.dll
    2010-10-26 13:25:00 1853312 ----a-w- c:\windows\system32\win32k.sys

    ============= FINISH: 16:16:16.29 ===============


    Ark.txt Log


    GMER 1.0.15.15530 - http://www.gmer.net
    Rootkit scan 2011-01-16 18:48:02
    Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 Intel___ rev.1.0.
    Running: 8yr3xfgc.exe; Driver: C:\DOCUME~1\Steve\LOCALS~1\Temp\awtdypow.sys


    ---- System - GMER 1.0.15 ----

    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateProcess [0xF6FD0CD6]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateProcessEx [0xF6FD0CF0]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwCreateThread [0xF6FCFE8C]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwLoadDriver [0xF6FD01BC]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwMapViewOfSection [0xF6FCFBCC]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwOpenSection [0xF6FD05EE]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwRenameKey [0xF6FD188C]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSetSystemInformation [0xF6FD043E]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSuspendProcess [0xF6FCFA4C]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSuspendThread [0xF6FCFEC0]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwSystemDebugControl [0xF6FD0042]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwTerminateProcess [0xF6FCF9A6]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwTerminateThread [0xF6FCFB06]
    SSDT \??\C:\Program Files\Charter Security Suite\HIPS\drivers\fshs.sys (HIPS 32-bit kernel module/F-Secure Corporation) ZwWriteVirtualMemory [0xF6FCFF86]

    INT 0x01 \??\C:\DOCUME~1\Steve\LOCALS~1\Temp\mbr.sys B3DC3C42

    Code fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation) IoCreateDevice

    ---- Kernel code sections - GMER 1.0.15 ----

    .text ntkrnlpa.exe!ZwCallbackReturn + 2FD8 80504874 12 Bytes [4C, FA, FC, F6, C0, FE, FC, ...]
    ? C:\DOCUME~1\Steve\LOCALS~1\Temp\mbr.sys The system cannot find the file specified. !

    ---- User code sections - GMER 1.0.15 ----

    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0282000C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0282100C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0282200C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0282300C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0282700C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0282500C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0282600C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0282800C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0282900C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0282400C
    .text C:\Program Files\Java\jre6\bin\jqs.exe[244] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0282A00C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0087000C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0087100C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0087200C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0087300C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0087700C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0087500C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0087600C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0087800C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0087400C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0087A00C
    .text C:\Program Files\Bonjour\mDNSResponder.exe[312] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0087900C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00A1000C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00A1100C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A1200C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00A1300C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00A1400C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00A1A00C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00A1700C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00A1500C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00A1600C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00A1800C
    .text C:\WINDOWS\eHome\ehRecvr.exe[476] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00A1900C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0219000C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0219100C
    .text C:\WINDOWS\eHome\ehSched.exe[532] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0219200C
    .text C:\WINDOWS\eHome\ehSched.exe[532] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0219300C
    .text C:\WINDOWS\eHome\ehSched.exe[532] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0219400C
    .text C:\WINDOWS\eHome\ehSched.exe[532] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0219A00C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0219700C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0219500C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0219600C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0219800C
    .text C:\WINDOWS\eHome\ehSched.exe[532] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0219900C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F3000C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00F3100C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F3200C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00F3300C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00F3400C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00F3A00C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00F3700C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00F3500C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00F3600C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00F3800C
    .text C:\WINDOWS\system32\dlcccoms.exe[636] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00F3900C
    .text C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0113000C
    .text C:\WINDOWS\system32\winlogon.exe[788] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0113100C
    .text C:\WINDOWS\system32\winlogon.exe[788] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0113200C
    .text C:\WINDOWS\system32\winlogon.exe[788] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0113300C
    .text C:\WINDOWS\system32\winlogon.exe[788] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0113700C
    .text C:\WINDOWS\system32\winlogon.exe[788] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0113500C
    .text C:\WINDOWS\system32\winlogon.exe[788] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0113600C
    .text C:\WINDOWS\system32\winlogon.exe[788] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0113800C
    .text C:\WINDOWS\system32\winlogon.exe[788] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0113400C
    .text C:\WINDOWS\system32\winlogon.exe[788] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0113A00C
    .text C:\WINDOWS\system32\winlogon.exe[788] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0113900C
    .text C:\WINDOWS\system32\lsass.exe[848] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C7000C
    .text C:\WINDOWS\system32\lsass.exe[848] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00C7100C
    .text C:\WINDOWS\system32\lsass.exe[848] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C7200C
    .text C:\WINDOWS\system32\lsass.exe[848] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00C7300C
    .text C:\WINDOWS\system32\lsass.exe[848] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00C7700C
    .text C:\WINDOWS\system32\lsass.exe[848] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00C7500C
    .text C:\WINDOWS\system32\lsass.exe[848] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00C7600C
    .text C:\WINDOWS\system32\lsass.exe[848] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00C7800C
    .text C:\WINDOWS\system32\lsass.exe[848] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00C7400C
    .text C:\WINDOWS\system32\lsass.exe[848] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00C7A00C
    .text C:\WINDOWS\system32\lsass.exe[848] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00C7900C
    .text C:\Program Files\Charter Security Suite\Common\FSM32.EXE[908] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 03D7000C
    .text C:\Program Files\Charter Security Suite\Common\FSM32.EXE[908] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 03D7100C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B2000C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00B2100C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B2200C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00B2300C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00B2700C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00B2500C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00B2600C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00B2800C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00B2400C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00B2A00C
    .text C:\Program Files\iPod\bin\iPodService.exe[964] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00B2900C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B3000C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00B3100C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B3200C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00B3300C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00B3400C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00B3A00C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00B3900C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00B3700C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00B3500C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00B3600C
    .text C:\WINDOWS\system32\Ati2evxx.exe[1008] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00B3800C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0099000C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0099100C
    .text C:\WINDOWS\system32\dllhost.exe[1124] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0099200C
    .text C:\WINDOWS\system32\dllhost.exe[1124] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0099300C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0099900C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0099700C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0099500C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0099600C
    .text C:\WINDOWS\system32\dllhost.exe[1124] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0099800C
    .text C:\WINDOWS\system32\dllhost.exe[1124] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0099400C
    .text C:\WINDOWS\system32\dllhost.exe[1124] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0099A00C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 008F000C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 008F100C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 008F200C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 008F300C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 008F700C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 008F500C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 008F600C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 008F800C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 008F900C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 008F400C
    .text C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1640] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 008FA00C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0064000C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0064100C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0064200C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0064300C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0064700C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0064500C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0064600C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0064800C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0064400C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0064A00C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1884] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0064900C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00CB000C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00CB100C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00CB200C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00CB300C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00CB700C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00CB500C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00CB600C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00CB800C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00CB400C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00CBA00C
    .text C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1908] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00CB900C
    .text C:\WINDOWS\Explorer.EXE[2032] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C1000C
    .text C:\WINDOWS\Explorer.EXE[2032] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00C1100C
    .text C:\WINDOWS\Explorer.EXE[2032] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C1200C
    .text C:\WINDOWS\Explorer.EXE[2032] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00C1300C
    .text C:\WINDOWS\Explorer.EXE[2032] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00C1700C
    .text C:\WINDOWS\Explorer.EXE[2032] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00C1500C
    .text C:\WINDOWS\Explorer.EXE[2032] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00C1600C
    .text C:\WINDOWS\Explorer.EXE[2032] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00C1800C
    .text C:\WINDOWS\Explorer.EXE[2032] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00C1400C
    .text C:\WINDOWS\Explorer.EXE[2032] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00C1A00C
    .text C:\WINDOWS\Explorer.EXE[2032] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00C1900C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 02E7000C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 02E7100C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02E7200C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 02E7300C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 02E7400C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 02E7A00C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 02E7700C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 02E7500C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 02E7600C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 02E7800C
    .text C:\WINDOWS\ehome\ehtray.exe[2072] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 02E7900C
    .text C:\WINDOWS\stsystra.exe[2084] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C7000C
    .text C:\WINDOWS\stsystra.exe[2084] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00C7100C
    .text C:\WINDOWS\stsystra.exe[2084] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C7200C
    .text C:\WINDOWS\stsystra.exe[2084] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00C7300C
    .text C:\WINDOWS\stsystra.exe[2084] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00C7700C
    .text C:\WINDOWS\stsystra.exe[2084] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00C7500C
    .text C:\WINDOWS\stsystra.exe[2084] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00C7600C
    .text C:\WINDOWS\stsystra.exe[2084] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00C7800C
    .text C:\WINDOWS\stsystra.exe[2084] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00C7400C
    .text C:\WINDOWS\stsystra.exe[2084] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00C7A00C
    .text C:\WINDOWS\stsystra.exe[2084] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00C7900C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0385000C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0385100C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0385200C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0385300C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0385700C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0385500C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0385600C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0385800C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0385400C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0385A00C
    .text C:\Program Files\CyberLink\PowerDVD DX\PDVDDXSrv.exe[2100] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0385900C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00AD000C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00AD100C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AD200C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00AD300C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00AD400C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00ADA00C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00AD700C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00AD500C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00AD600C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00AD800C
    .text C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe[2188] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00AD900C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00C7000C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00C7100C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00C7200C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00C7300C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00C7400C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00C7A00C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00C7700C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00C7500C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00C7600C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00C7800C
    .text C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb13.exe[2216] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00C7900C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0062000C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0062100C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0062200C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0062300C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0062700C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0062500C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0062600C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0062800C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0062400C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe[2320] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0062900C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ntdll.dll!NtCreateProcess 7C90D14E 3 Bytes JMP 0091000C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ntdll.dll!NtCreateProcess + 4 7C90D152 1 Byte [84]
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ntdll.dll!NtCreateProcessEx 7C90D15E 3 Bytes JMP 0091100C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ntdll.dll!NtCreateProcessEx + 4 7C90D162 1 Byte [84]
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0091200C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0091300C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0091400C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0091A00C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0091700C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0091500C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0091600C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0091800C
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2364] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0091900C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0272000C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0272100C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0272200C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0272300C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0272700C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0272500C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0272600C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0272800C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0272400C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0272A00C
    .text C:\WINDOWS\system32\hphmon06.exe[2372] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0272900C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0127000C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0127100C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0127200C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0127300C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0127400C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0127A00C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0127700C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0127500C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ADVAPI32.dll!ControlService 77DF4A09 3 Bytes JMP 0127600C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ADVAPI32.dll!ControlService + 4 77DF4A0D 1 Byte [89]
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0127800C
    .text C:\PROGRA~1\HP\{BA2D9~1\pexpress\hphPED06.exe[2388] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0127900C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0082000C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0082100C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0082200C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0082300C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0082400C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0082900C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0082700C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0082500C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0082600C
    .text C:\WINDOWS\system32\taskswitch.exe[2396] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0082800C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0231000C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0231100C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0231200C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0231300C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0231700C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0231500C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0231600C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0231800C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0231400C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0231A00C
    .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[2424] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0231900C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0C7B000C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0C7B100C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0C7B200C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0C7B300C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0C7B400C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0C7BA00C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0C7B700C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0C7B500C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0C7B600C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0C7B800C
    .text C:\Program Files\iTunes\iTunesHelper.exe[2576] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0C7B900C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0196000C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0196100C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0196200C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0196300C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0196900C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0196700C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0196500C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0196600C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0196800C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0196400C
    .text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe[2624] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0196A00C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00EE000C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00EE100C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00EE200C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00EE300C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00EE700C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00EE500C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00EE600C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00EE800C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00EE400C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00EEA00C
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2648] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00EE900C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00E8000C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00E8100C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00E8200C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00E8300C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00E8400C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00E8A00C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00E8700C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00E8500C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00E8600C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00E8800C
    .text C:\Program Files\HP\digital imaging\bin\hpqtra08.exe[2800] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00E8900C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 064E000C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 064E100C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 064E200C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 064E300C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 064E700C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 064E500C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 064E600C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 064E800C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 064E400C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 064EA00C
    .text C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe[2816] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 064E900C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00AA000C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00AA100C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00AA200C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00AA300C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00AA700C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00AA500C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00AA600C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00AA800C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00AA400C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00AAA00C
    .text C:\WINDOWS\system32\taskmgr.exe[2888] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00AA900C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 02E5000C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 02E5100C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02E5200C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 02E5300C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 02E5400C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 02E5A00C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 02E5900C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 02E5700C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 02E5500C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 02E5600C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMStatus.exe[2908] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 02E5800C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 025D000C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 025D100C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 025D200C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 025D300C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 025D700C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 025D500C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 025D600C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 025D800C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 025D400C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 025DA00C
    .text C:\Program Files\Windows Desktop Search\WindowsSearch.exe[2936] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 025D900C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00F7000C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00F7100C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00F7200C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00F7300C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00F7700C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00F7500C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00F7600C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00F7800C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00F7400C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00F7A00C
    .text C:\Program Files\desktop weather\desktopweather_1219728.exe[2972] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00F7900C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 02EB000C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 02EB100C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 02EB200C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 02EB300C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 02EB700C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 02EB500C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 02EB600C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 02EB800C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 02EB400C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 02EBA00C
    .text C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3416] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 02EB900C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 04D7000C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 04D7100C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 04D7200C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 04D7300C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 04D7700C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 04D7500C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 04D7600C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 04D7800C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 04D7400C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 04D7A00C
    .text C:\Program Files\Western Digital\WD SmartWare\WD Drive Manager\WDDMService.exe[3512] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 04D7900C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00D9000C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00D9100C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00D9200C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00D9300C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00D9700C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00D9500C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00D9600C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00D9800C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00D9400C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00D9A00C
    .text C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[3704] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00D9900C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0229000C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0229100C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0229200C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0229300C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0229400C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0229900C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0229700C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0229500C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0229600C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WLService.exe[3748] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0229800C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0118000C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0118100C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0118200C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] kernel32.dll!WriteFile 7C810E27 7 Bytes JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0118300C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0118700C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0118500C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0118600C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0118800C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0118400C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0118A00C
    .text C:\WINDOWS\system32\SearchIndexer.exe[3776] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0118900C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0325000C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0325100C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0325200C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0325300C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0325700C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0325500C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0325600C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0325800C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0325400C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0325A00C
    .text C:\Program Files\Linksys Wireless-G PCI Wireless Network Monitor\WMP54Gv4.exe[3780] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0325900C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00B2000C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00B2100C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00B2200C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00B2300C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00B2400C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00B2A00C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00B2700C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00B2500C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00B2600C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00B2800C
    .text C:\WINDOWS\ehome\mcrdsvc.exe[3892] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00B2900C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0243000C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0243100C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0243200C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0243300C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0243400C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0243A00C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0243700C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0243500C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0243600C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0243800C
    .text C:\WINDOWS\eHome\ehmsas.exe[4008] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0243900C
    .text C:\WINDOWS\System32\alg.exe[4204] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 00A2000C
    .text C:\WINDOWS\System32\alg.exe[4204] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 00A2100C
    .text C:\WINDOWS\System32\alg.exe[4204] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 00A2200C
    .text C:\WINDOWS\System32\alg.exe[4204] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 00A2300C
    .text C:\WINDOWS\System32\alg.exe[4204] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 00A2400C
    .text C:\WINDOWS\System32\alg.exe[4204] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 00A2A00C
    .text C:\WINDOWS\System32\alg.exe[4204] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 00A2700C
    .text C:\WINDOWS\System32\alg.exe[4204] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 00A2500C
    .text C:\WINDOWS\System32\alg.exe[4204] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 00A2600C
    .text C:\WINDOWS\System32\alg.exe[4204] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 00A2800C
    .text C:\WINDOWS\System32\alg.exe[4204] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 00A2900C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ntdll.dll!NtCreateProcess 7C90D14E 5 Bytes JMP 0038000C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ntdll.dll!NtCreateProcessEx 7C90D15E 5 Bytes JMP 0038100C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] kernel32.dll!LoadLibraryExW 7C801AF5 5 Bytes JMP 0038200C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] kernel32.dll!TerminateThread 7C81CB3B 5 Bytes JMP 0038300C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 0038400C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] USER32.dll!DdeConnect 7E4581C3 5 Bytes JMP 0038900C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ADVAPI32.dll!CloseServiceHandle 77DE6CE5 5 Bytes JMP 0038700C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ADVAPI32.dll!OpenServiceW 77DE6FFD 5 Bytes JMP 0038500C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ADVAPI32.dll!ControlService 77DF4A09 5 Bytes JMP 0038600C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ADVAPI32.dll!CreateServiceW 77E373A9 5 Bytes JMP 0038800C
    .text C:\Documents and Settings\Steve\Desktop\8yr3xfgc.exe[4684] ole32.dll!CoCreateInstanceEx 774FF154 5 Bytes JMP 0038A00C

    ---- Devices - GMER 1.0.15 ----

    Device Ntfs.sys (NT File System Driver/Microsoft Corporation)
    Device Udfs.SYS (UDF File System Driver/Microsoft Corporation)
    Device \Driver\Tcpip \Device\Ip fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
    Device \Driver\Tcpip \Device\Tcp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)

    AttachedDevice \Driver\Tcpip \Device\Tcp fssfltr_tdi.sys (Family Safety Filter Driver (TDI)/Microsoft Corporation)

    Device \Driver\Tcpip \Device\Udp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
    Device \Driver\Tcpip \Device\RawIp fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
    Device \Driver\Tcpip \Device\IPMULTICAST fsdfw.sys (F-Secure Internet Shield Driver/F-Secure Corporation)
    Device mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
    Device Cdfs.SYS (CD-ROM File System Driver/Microsoft Corporation)

    ---- EOF - GMER 1.0.15 ----
     
    wausau99, Jan 16, 2011
    #1
  2. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    Attaching the Attach.txt log.
     

    Attached Files:

    wausau99, Jan 17, 2011
    #2
  3. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    bump
     
    wausau99, Jan 19, 2011
    #3
  4. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    Bump
     
    wausau99, Jan 21, 2011
    #4
  5. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,236
    First Name:
    Derek
    no obvious signs of malware there

    first thing I wopuld suspect is charter internet security playing up
    uninstall it
    reboot & see if problem goes away
     
    dvk01, Jan 22, 2011
    #5
  6. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    Ok, I'll give it a try and let you know.
     
    wausau99, Jan 22, 2011
    #6
  7. wausau99

    wausau99 Thread Starter

    Joined:
    Jan 8, 2001
    Messages:
    260
    Ok, so it seems to have been Charter Internet Security. I "Unloaded" it and the reloaded it and everything has been working fine since. 3 days now and the Internet has not locked up since.
     
    wausau99, Jan 26, 2011
    #7
  8. dvk01

    dvk01 Moderator Malware Specialist

    Joined:
    Dec 14, 2002
    Messages:
    56,236
    First Name:
    Derek
    glad it was easily fixed
     
    dvk01, Jan 27, 2011
    #8

  9. Sponsor

As Seen On
As Seen On...

Welcome to Tech Support Guy!

Are you looking for the solution to your computer problem? Join our site today to ask your question. This site is completely free -- paid for by advertisers and donations.

If you're not already familiar with forums, watch our Welcome Guide to get started.

Join over 733,556 other people just like you!

Loading...
Similar Threads - Multiple instances iexplorer
  1. Dano2

    New Multiple Chrome instances listed in Task Manager

    Dano2, Jun 11, 2019, in forum: Virus & Other Malware Removal
    Replies:
    0
    Views:
    316
    Dano2
    Jun 11, 2019
Thread Status:
Not open for further replies.

Short URL to this thread: https://techguy.org/975118

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...
    Dismiss Notice