Encore un log hijackthis ^^

Bonjour VIRUS-C-C

désolé pour ce petit retard, je me trouve en guyane donc bjr le décalage horaire ;)

Voici comme prévue l'adresse du lien de mon scan fait avec ZHPDiag:

http://www.cijoint.fr/cjlink.php?file=cj201009/cijmvMfMrs.txt

Voici le log crée par mbr: A mon avis j'ai du loupé un truc

Stealth MBR rootkit/Mebroot/Sinowal detector 0.3.7 by Gmer, http://www.gmer.net

device: opened successfully
user: error reading MBR
kernel: error reading MBR

Voici le log crée par deffoger:

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:00 on 03/09/2010 (kevin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...
Unable to read sptd.sys
SPTD -> Disabled (Service running -> reboot required)


-=E.O.F=-

j'ai un soucis avec le log de gmer, le site cijoint.fr ne veut pas le prendre. J'ouvre mon log avec bloc note, et le site me dit qu'il ne prend pas en charge les fichier .log

ok, voici donc:

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-03 18:54:46
Windows 6.0.6002 Service Pack 2
Running: mup3ffzr.exe; Driver: C:\Users\kevin\AppData\Local\Temp\ugdcipob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x90A7F510]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcConnectPort [0x90A808D2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcCreatePort [0x90A7F6FC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0x90A7E832]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0x90A7F176]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0x90A7E70E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0x90A7EEF4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x90A80562]
SSDT 9EB3E04C ZwCreateThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0x90A8015A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0x90A7EACE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0x90A7F352]
SSDT 9EB3E038 ZwOpenProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0x90A7ED7E]
SSDT 9EB3E03D ZwOpenThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x90A7FBEE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0x90A7FEA2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0x90A80352]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0x90A7EA68]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0x90A7EC6A]
SSDT 9EB3E047 ZwTerminateProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0x90A7E2F6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThreadEx [0x90A7F80C]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!KeInsertQueue + 309 84078900 4 Bytes [10, F5, A7, 90] {ADC CH, DH; CMPSD ; NOP }
.text ntoskrnl.exe!KeInsertQueue + 32D 84078924 8 Bytes [D2, 08, A8, 90, FC, F6, A7, ...]
.text ntoskrnl.exe!KeInsertQueue + 3B1 840789A8 4 Bytes CALL E8881A54
.text ntoskrnl.exe!KeInsertQueue + 3C9 840789C0 4 Bytes [76, F1, A7, 90] {JBE 0xfffffffffffffff3; CMPSD ; NOP }
.text ntoskrnl.exe!KeInsertQueue + 3F5 840789EC 4 Bytes [0E, E7, A7, 90] {PUSH CS; OUT 0xa7, EAX; NOP }
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x9100E340, 0x3EE687, 0xE8000020]
PAGE spsys.sys!?SPVersion@@3PADA + 1ABF 9F05B03F 110 Bytes [8B, FF, 55, 8B, EC, 8B, 45, ...]
PAGE spsys.sys!?SPVersion@@3PADA + 1B2F 9F05B0AF 1 Byte [16]
PAGE spsys.sys!?SPVersion@@3PADA + 1B2F 9F05B0AF 128 Bytes [16, 3B, C8, 75, E2, B0, 01, ...]
PAGE spsys.sys!?SPVersion@@3PADA + 1BB0 9F05B130 6 Bytes [0E, 83, 78, 14, 01, 75]
PAGE spsys.sys!?SPVersion@@3PADA + 1BB7 9F05B137 2298 Bytes [83, 78, 18, 37, 75, 02, B3, ...]
PAGE ...

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] WS2_32.dll!WSASocketW 76D134EB 7 Bytes JMP 10025840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] WS2_32.dll!WSASocketA 76D18FA9 5 Bytes JMP 10025860 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] WS2_32.dll!WSASocketW 76D134EB 7 Bytes JMP 10025840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] WS2_32.dll!WSASocketA 76D18FA9 5 Bytes JMP 10025860 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Con

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-03 18:54:46
Windows 6.0.6002 Service Pack 2
Running: mup3ffzr.exe; Driver: C:\Users\kevin\AppData\Local\Temp\ugdcipob.sys


---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAdjustPrivilegesToken [0x90A7F510]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcConnectPort [0x90A808D2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwAlpcCreatePort [0x90A7F6FC]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwConnectPort [0x90A7E832]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateFile [0x90A7F176]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreatePort [0x90A7E70E]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSection [0x90A7EEF4]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateSymbolicLinkObject [0x90A80562]
SSDT 9EB3E04C ZwCreateThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwLoadDriver [0x90A8015A]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwMakeTemporaryObject [0x90A7EACE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenFile [0x90A7F352]
SSDT 9EB3E038 ZwOpenProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwOpenSection [0x90A7ED7E]
SSDT 9EB3E03D ZwOpenThread
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwRequestWaitReplyPort [0x90A7FBEE]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSecureConnectPort [0x90A7FEA2]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSetSystemInformation [0x90A80352]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwShutdownSystem [0x90A7EA68]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwSystemDebugControl [0x90A7EC6A]
SSDT 9EB3E047 ZwTerminateProcess
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwTerminateThread [0x90A7E2F6]
SSDT \SystemRoot\System32\DRIVERS\cmdguard.sys (COMODO Internet Security Sandbox Driver/COMODO) ZwCreateThreadEx [0x90A7F80C]

---- Kernel code sections - GMER 1.0.15 ----

.text ntoskrnl.exe!KeInsertQueue + 309 84078900 4 Bytes [10, F5, A7, 90] {ADC CH, DH; CMPSD ; NOP }
.text ntoskrnl.exe!KeInsertQueue + 32D 84078924 8 Bytes [D2, 08, A8, 90, FC, F6, A7, ...]
.text ntoskrnl.exe!KeInsertQueue + 3B1 840789A8 4 Bytes CALL E8881A54
.text ntoskrnl.exe!KeInsertQueue + 3C9 840789C0 4 Bytes [76, F1, A7, 90] {JBE 0xfffffffffffffff3; CMPSD ; NOP }
.text ntoskrnl.exe!KeInsertQueue + 3F5 840789EC 4 Bytes [0E, E7, A7, 90] {PUSH CS; OUT 0xa7, EAX; NOP }
.text ...
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x9100E340, 0x3EE687, 0xE8000020]
PAGE spsys.sys!?SPVersion@@3PADA + 1ABF 9F05B03F 110 Bytes [8B, FF, 55, 8B, EC, 8B, 45, ...]
PAGE spsys.sys!?SPVersion@@3PADA + 1B2F 9F05B0AF 1 Byte [16]
PAGE spsys.sys!?SPVersion@@3PADA + 1B2F 9F05B0AF 128 Bytes [16, 3B, C8, 75, E2, B0, 01, ...]
PAGE spsys.sys!?SPVersion@@3PADA + 1BB0 9F05B130 6 Bytes [0E, 83, 78, 14, 01, 75]
PAGE spsys.sys!?SPVersion@@3PADA + 1BB7 9F05B137 2298 Bytes [83, 78, 18, 37, 75, 02, B3, ...]
PAGE ...

---- User code sections - GMER 1.0.15 ----

.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] WS2_32.dll!WSASocketW 76D134EB 7 Bytes JMP 10025840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\wininit.exe[644] WS2_32.dll!WSASocketA 76D18FA9 5 Bytes JMP 10025860 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\services.exe[692] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] WS2_32.dll!WSASocketW 76D134EB 7 Bytes JMP 10025840 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsass.exe[708] WS2_32.dll!WSASocketA 76D18FA9 5 Bytes JMP 10025860 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!CopyFileExA 76DD19F9 5 Bytes JMP 10025B20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!WinExec 76DD5CF7 5 Bytes JMP 10025960 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] kernel32.dll!LoadModule 76DD5E4F 5 Bytes JMP 10025C20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] USER32.dll!EndTask 759CAD32 5 Bytes JMP 10027420 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateProcessAsUserA 76BDCEB9 5 Bytes JMP 1001FF40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateProcessAsUserW 76BF1EE9 5 Bytes JMP 1001F730 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!OpenServiceA 76BF2EBD 7 Bytes JMP 100265F0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!OpenServiceW 76BF8354 7 Bytes JMP 10026890 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateServiceW 76C19EB4 7 Bytes JMP 10026B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Windows\system32\lsm.exe[716] ADVAPI32.dll!CreateServiceA 76C572A1 7 Bytes JMP 10026DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrLoadDll 77249390 5 Bytes JMP 100234C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrUnloadDll 7725BA50 7 Bytes JMP 1001CFE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!LdrGetProcedureAddress 77265A88 5 Bytes JMP 10025CA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtAllocateVirtualMemory 77284134 5 Bytes JMP 10025D20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtClose 77284314 5 Bytes JMP 1001CEC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateFile 772843D4 5 Bytes JMP 10025DA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateProcess 77284494 5 Bytes JMP 10025E40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtCreateProcessEx 772844A4 5 Bytes JMP 10025E20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtDeleteFile 772847B4 5 Bytes JMP 10025D60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtFreeVirtualMemory 77284944 5 Bytes JMP 10025C60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtLoadDriver 77284A64 5 Bytes JMP 10025D00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtOpenFile 77284BB4 5 Bytes JMP 10025D80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtProtectVirtualMemory 77284D34 5 Bytes JMP 10025D40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtSetInformationProcess 77285324 5 Bytes JMP 10025CC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtUnloadDriver 77285574 5 Bytes JMP 10025CE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!NtWriteVirtualMemory 77285674 5 Bytes JMP 10025DC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] ntdll.dll!RtlAllocateHeap 77286570 5 Bytes JMP 10025C80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateProcessW 76D41BF3 5 Bytes JMP 10025DE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateProcessA 76D41C28 5 Bytes JMP 10025E00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!VirtualProtect 76D41DC3 5 Bytes JMP 10025940 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!OpenFile 76D4355A 5 Bytes JMP 10025BC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileW 76D4A2F2 5 Bytes JMP 10025AC0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileExW 76D50211 7 Bytes JMP 10025B00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileW 76D50299 5 Bytes JMP 10025B40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!DeleteFileW 76D5F4B6 5 Bytes JMP 10025A00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!DeleteFileA 76D5F5D2 5 Bytes JMP 10025A20 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileWithProgressW 76D610A4 5 Bytes JMP 10025A40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileExW 76D610C8 5 Bytes JMP 10025A80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryExW 76D69109 7 Bytes JMP 10025BE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryW 76D69362 5 Bytes JMP 10025980 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryExA 76D694B4 5 Bytes JMP 10025C00 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!LoadLibraryA 76D694DC 5 Bytes JMP 100259A0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetProcAddress 76D8903B 5 Bytes JMP 10025C40 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetModuleHandleA 76D892A5 5 Bytes JMP 100259E0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!GetModuleHandleW 76D8A804 5 Bytes JMP 100259C0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateFileW 76D8AECB 5 Bytes JMP 10025B80 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CreateFileA 76D8CE5F 5 Bytes JMP 10025BA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileExA 76D90F0A 5 Bytes JMP 10025AA0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileWithProgressA 76D90F2A 5 Bytes JMP 10025A60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!CopyFileA 76D92433 5 Bytes JMP 10025B60 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[860] kernel32.dll!MoveFileA 76DCF641 5 Bytes JMP 10025AE0 C:\Windows\system32\guard32.dll (COMODO Internet Security/COMODO)
.text C:\Program Files\Common Files\ArcSoft\Connection Service\Bin\ACService.e

sa ne veut pas le coppier en entier on dirait, je recommence le scan....

cmt le faire passer par cijoint.fr si il n'accepte pas les fichier .log ?

Aussi, il faut qu'a la fin de tout sa je fasse re-nable c'est sa ?

ComboFix 10-09-02.04 - kevin 03/09/2010 20:34:02.1.2 - x86
Microsoft® Windows Vista(TM) Édition Familiale Premium 6.0.6002.2.1252.33.1036.18.3066.2148 [GMT 2:00]
Lancé depuis: c:\users\kevin\Desktop\ComboFix.exe
SP: Spybot - Search and Destroy *disabled* (Updated) {ED588FAF-1B8F-43B4-ACA8-8E3C85DADBE9}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
.

(((((((((((((((((((((((((((((((((((( Autres suppressions ))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\users\kevin\AppData\Roaming\Microsoft\Windows\Recent\Register Warcraft III.url
c:\users\kevin\AppData\Roaming\Microsoft\Windows\Recent\TechSupport.url
c:\windows\SEC
c:\windows\SEC\172100logo.bmp
c:\windows\SEC\banner.png
c:\windows\SEC\Computer.png
c:\windows\SEC\Media _S_ Logo.png
c:\windows\SEC\Samsung.png
c:\windows\SEC\Samsung2.png
c:\windows\SEC\SamsungLogo.png
c:\windows\SEC\Wallpapers\wallpaper.jpg
c:\windows\SEC\Wallpapers\wallpaper1.jpg
c:\windows\SEC\Wallpapers\Wallpaper2.jpg
c:\windows\system32\%appdata%
D:\install.exe

.
((((((((((((((((((((((((((((((((((((((( Pilotes/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Service_Boonty Games


((((((((((((((((((((((((((((( Fichiers créés du 2010-08-03 au 2010-09-03 ))))))))))))))))))))))))))))))))))))
.

2010-09-03 10:01 . 2010-09-03 10:04 -------- d-----w- c:\program files\ZHPDiag
2010-09-01 23:17 . 2010-09-01 23:20 -------- d-----w- c:\program files\FineRecovery
2010-09-01 22:03 . 2010-09-01 22:03 -------- d-----w- c:\program files\Common Files\Java
2010-09-01 22:02 . 2010-09-01 22:02 -------- d-----w- c:\program files\Java
2010-08-31 20:05 . 2010-08-31 20:05 -------- d-----w- c:\program files\SIW
2010-08-27 20:52 . 2010-08-27 20:52 40793 ----a-w- C:\UsbFix_Upload_Me_PC-DE-KEVIN.zip
2010-08-27 20:42 . 2010-09-02 20:53 -------- d-----w- C:\UsbFix
2010-08-25 11:05 . 2010-09-02 08:42 -------- d-----w- c:\programdata\COMODO
2010-08-25 11:02 . 2010-08-25 11:02 -------- d-----w- c:\program files\COMODO
2010-08-25 10:59 . 2010-08-25 10:59 -------- d-----w- c:\programdata\Comodo Downloader
2010-08-24 21:43 . 2010-08-24 21:43 -------- d-----w- c:\program files\Microsoft.NET
2010-08-20 10:13 . 2009-11-25 10:19 56816 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2010-08-20 10:13 . 2009-03-30 08:32 96104 ----a-w- c:\windows\system32\drivers\avipbb.sys
2010-08-20 10:13 . 2010-08-20 10:13 -------- d-----w- c:\programdata\Avira
2010-08-20 10:13 . 2010-08-20 10:13 -------- d-----w- c:\program files\Avira
2010-08-20 10:04 . 2010-08-20 10:04 -------- d-----w- c:\programdata\Kaspersky Lab Setup Files
2010-08-19 21:22 . 2010-08-19 21:22 -------- d-----w- C:\Programme
2010-08-16 14:26 . 2010-09-01 23:26 -------- d-----w- c:\program files\Governor of Poker
2010-08-11 17:33 . 2010-05-27 20:08 81920 ----a-w- c:\windows\system32\iccvid.dll
2010-08-11 17:33 . 2010-06-11 16:16 274944 ----a-w- c:\windows\system32\schannel.dll
2010-08-11 17:33 . 2010-06-21 13:37 2037760 ----a-w- c:\windows\system32\win32k.sys
2010-08-11 17:33 . 2010-06-18 17:31 36864 ----a-w- c:\windows\system32\rtutils.dll
2010-08-11 17:33 . 2010-06-08 17:35 3548040 ----a-w- c:\windows\system32\ntoskrnl.exe
2010-08-11 17:33 . 2010-06-08 17:35 3600768 ----a-w- c:\windows\system32\ntkrnlpa.exe
2010-08-11 17:31 . 2010-06-11 16:15 1248768 ----a-w- c:\windows\system32\msxml3.dll
2010-08-11 17:31 . 2010-06-18 15:04 302080 ----a-w- c:\windows\system32\drivers\srv.sys
2010-08-11 17:31 . 2010-06-18 15:04 144896 ----a-w- c:\windows\system32\drivers\srv2.sys
2010-08-11 17:31 . 2010-06-16 16:04 905088 ----a-w- c:\windows\system32\drivers\tcpip.sys
2010-08-06 13:50 . 2010-09-03 18:29 16968 ----a-w- c:\windows\system32\drivers\hitmanpro35.sys
2010-08-06 13:48 . 2010-08-06 13:49 -------- d-----w- c:\programdata\Hitman Pro
2010-08-06 13:48 . 2010-08-06 13:48 -------- d-----w- c:\program files\Hitman Pro 3.5
2010-08-06 00:47 . 2010-08-06 00:47 -------- d-----w- c:\program files\Defraggler

.
(((((((((((((((((((((((((((((((((( Compte-rendu de Find3M ))))))))))))))))))))))))))))))))))))))))))))))))
.
2010-09-03 18:42 . 2008-09-12 19:22 12 ----a-w- c:\windows\bthservsdp.dat
2010-09-03 18:36 . 2008-09-11 03:29 694122 ----a-w- c:\windows\system32\perfh00C.dat
2010-09-03 18:36 . 2008-09-11 03:29 131708 ----a-w- c:\windows\system32\perfc00C.dat
2010-09-03 16:59 . 2009-04-25 16:07 1 ----a-w- c:\users\kevin\AppData\Roaming\OpenOffice.org\3\user\uno_packages\cache\stamp.sys
2010-09-03 16:01 . 2009-04-24 20:51 -------- d-----w- c:\program files\Microsoft Silverlight
2010-09-03 10:01 . 2009-10-28 21:14 146771 ----a-w- c:\programdata\nvModes.dat
2010-09-02 00:16 . 2009-04-24 15:49 -------- d-----w- c:\programdata\Spybot - Search & Destroy
2010-09-01 22:02 . 2010-04-15 11:11 423656 ----a-w- c:\windows\system32\deployJava1.dll
2010-08-29 04:13 . 2010-05-31 16:17 -------- d-----w- c:\program files\MyDefrag v4.3.1
2010-08-28 02:04 . 2009-05-04 19:54 1356 ----a-w- c:\users\kevin\AppData\Local\d3d9caps.dat
2010-08-28 01:11 . 2010-05-17 23:05 -------- d-----w- c:\program files\BoontyGames
2010-08-27 20:09 . 2010-08-02 17:14 -------- d-----w- c:\program files\CCleaner
2010-08-25 14:25 . 2010-08-31 20:58 614544 ----a-w- c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\j5i2jlzi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
2010-08-25 14:25 . 2010-08-31 20:58 314816 ----a-w- c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\j5i2jlzi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
2010-08-20 17:45 . 2009-08-11 10:46 -------- d-----w- c:\program files\OrangeHSS
2010-08-20 17:45 . 2009-05-02 14:55 -------- d-----w- c:\program files\Google
2010-08-20 17:45 . 2009-04-24 15:27 -------- d-----w- c:\program files\Messenger Plus! Live
2010-08-20 10:40 . 2009-04-24 22:25 -------- d-----w- c:\users\kevin\AppData\Roaming\LimeWire
2010-08-20 10:39 . 2010-06-10 14:34 -------- d-----w- c:\program files\LimeWire
2010-08-20 10:21 . 2009-11-11 00:00 -------- d-----w- c:\program files\FileHippo.com
2010-08-20 10:02 . 2009-04-26 11:01 -------- d-----w- c:\users\kevin\AppData\Roaming\Media Player Classic
2010-08-16 13:48 . 2009-09-27 18:08 -------- d-----w- c:\program files\Glary Utilities
2010-08-11 17:31 . 2006-11-02 11:18 -------- d-----w- c:\program files\Windows Mail
2010-08-03 20:31 . 2010-07-31 11:48 -------- d-----w- c:\users\kevin\AppData\Roaming\vlc
2010-07-30 02:00 . 2009-04-26 10:36 -------- d-----w- c:\users\kevin\AppData\Roaming\dvdcss
2010-07-19 17:41 . 2010-07-19 17:41 -------- d-----w- c:\program files\Microsoft
2010-07-19 17:41 . 2009-04-24 13:24 -------- d-----w- c:\program files\Windows Live
2010-07-18 21:19 . 2009-11-11 10:21 -------- d-----w- c:\program files\Navilog1
2010-07-18 21:19 . 2009-09-08 20:12 -------- d-----w- c:\program files\Opera
2010-07-18 21:19 . 2009-05-23 17:35 -------- d-----w- c:\program files\Personal Media Manager
2010-07-18 21:19 . 2006-11-02 12:37 -------- d-----w- c:\program files\Windows Sidebar
2010-07-07 01:10 . 2010-06-14 23:42 -------- d-----w- c:\users\kevin\AppData\Roaming\Bioshock2
2010-06-26 06:05 . 2010-08-11 17:34 916480 ----a-w- c:\windows\system32\wininet.dll
2010-06-26 06:02 . 2010-08-11 17:34 71680 ----a-w- c:\windows\system32\iesetup.dll
2010-06-26 06:02 . 2010-08-11 17:34 109056 ----a-w- c:\windows\system32\iesysprep.dll
2010-06-26 04:25 . 2010-08-11 17:34 133632 ----a-w- c:\windows\system32\ieUnatt.exe
2010-06-15 22:09 . 2010-06-15 22:09 53248 ----a-r- c:\users\kevin\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe
2010-06-15 22:09 . 2010-03-05 15:25 16400 ----a-w- c:\windows\system32\drivers\LNonPnP.sys
.

((((((((((((((((((((((((((((((((( Points de chargement Reg ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* les éléments vides & les éléments initiaux légitimes ne sont pas listés
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Defender"="c:\program files\Windows Defender\MSASCui.exe" [2008-01-21 1008184]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2007-10-26 1029416]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2008-07-26 13548064]
"RtHDVCpl"="RtHDVCpl.exe" [2008-04-17 6111232]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2009-03-02 209153]
"COMODO Internet Security"="c:\program files\COMODO\COMODO Internet Security\cfp.exe" [2010-06-01 2039240]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2010-05-14 248552]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"UacDisableNotify"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"HonorAutoRunSetting"= 0 (0x0)

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=c:\windows\System32\guard32.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux5"=wdmaud.drv

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend]
@="Service"

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^BTTray.lnk]
backup=c:\windows\pss\BTTray.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Gamesurround Muse Pocket.lnk]
backup=c:\windows\pss\Gamesurround Muse Pocket.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
backup=c:\windows\pss\Logitech SetPoint.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Philips GoGear ARIA Device Manager.lnk]
backup=c:\windows\pss\Philips GoGear ARIA Device Manager.lnk.CommonStartup
backupExtension=.CommonStartup

[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Enregistrement du produit.lnk]
backup=c:\windows\pss\Logitech . Enregistrement du produit.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.0.lnk]
backup=c:\windows\pss\OpenOffice.org 3.0.lnk.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Registration Ghost Recon Advanced Warfighter.LNK]
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Ghost Recon Advanced Warfighter.LNK
backup=c:\windows\pss\Registration Ghost Recon Advanced Warfighter.LNK.Startup
backupExtension=.Startup

[HKLM\~\startupfolder\C:^Users^kevin^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Registration Tom Clancy's Rainbow Six Vegas.LNK]
path=c:\users\kevin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Registration Tom Clancy's Rainbow Six Vegas.LNK
backup=c:\windows\pss\Registration Tom Clancy's Rainbow Six Vegas.LNK.Startup
backupExtension=.Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Bluetooth Connection Assistant]
LBTWIZ.EXE -silent [X]
HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\EvtMgr6

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2010-06-09 08:06 976832 ----a-w- c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
2010-06-20 02:04 35760 ----a-w- c:\program files\Adobe\Reader 9.0\Reader\reader_sl.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGEIA PhysX SysTray]
2006-03-20 19:43 331776 ----a-w- c:\program files\AGEIA Technologies\TrayIcon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ArcSoft Connection Service]
2009-10-10 12:32 203264 ----a-w- c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACDaemon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
2010-04-01 09:16 357696 ----a-w- c:\program files\DAEMON Tools Lite\DTLite.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FileHippo.com]
2010-08-09 12:47 248832 ----a-w- c:\program files\FileHippo.com\UpdateChecker.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LightScribe Control Panel]
2007-06-20 10:49 451872 ----a-w- c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Malwarebytes Anti-Malware (reboot)]
2010-04-29 13:39 1090952 ----a-w- c:\program files\Malwarebytes' Anti-Malware\mbam.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ORAHSSSessionManager]
2008-06-10 09:14 107248 ----a-w- c:\program files\OrangeHSS\SessionManager\SessionManager.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sidebar]
2009-04-11 06:28 1233920 ----a-w- c:\program files\Windows Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
2010-05-14 09:44 248552 ----a-w- c:\program files\Common Files\Java\Java Update\jusched.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2008-01-21 02:25 202240 ----a-w- c:\program files\Windows Media Player\wmpnscfg.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XboxStat]
2007-09-27 01:05 734264 ----a-w- c:\program files\Microsoft Xbox 360 Accessories\XBoxStat.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ehTray.exe"=c:\windows\ehome\ehTray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NvMediaCenter"=RUNDLL32.EXE c:\windows\system32\NvMcTray.dll,NvTaskbarInit

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-disabled]
"Kernel and Hardware Abstraction Layer"=KHALMNPR.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc]
"VistaSp2"=hex(b):cd,0a,49,9a,45,e1,c9,01

R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R3 hitmanpro35;Hitman Pro 3.5 Support Driver;c:\windows\system32\drivers\hitmanpro35.sys [2010-09-03 16968]
R3 PCAMp50;PCAMp50 NDIS Protocol Driver;c:\windows\system32\Drivers\PCAMp50.sys [2006-11-28 28224]
R3 RTL8187B;TG123g USB Wireless Adapter;c:\windows\system32\DRIVERS\RTL8187B.sys [2007-07-18 281088]
R3 WPFFontCache_v0400;Cache de police de Windows Presentation Foundation 4.0.0.0;c:\windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe [2010-03-18 753504]
R4 sptd;sptd;c:\windows\system32\Drivers\sptd.sys [2010-04-21 691696]
S0 iaNvStor;Intel(R) Turbo Memory Controller;c:\windows\system32\DRIVERS\iaNvStor.sys [2008-05-08 226328]
S1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\DRIVERS\cmdguard.sys [2010-06-04 224240]
S1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\DRIVERS\cmdhlp.sys [2010-06-01 30112]
S2 AntiVirSchedulerService;Avira AntiVir Planificateur;c:\program files\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
S2 KMDFMEMIO;SAMSUNG Kernel Driver;c:\windows\system32\DRIVERS\kmdfmemio.sys [2008-09-12 13312]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TeamViewer5;TeamViewer 5;c:\program files\TeamViewer\Version5\TeamViewer_Service.exe [2010-07-06 173352]
S3 NETw5v32;Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows Vista 32 Bit;c:\windows\system32\DRIVERS\NETw5v32.sys [2009-10-26 4247552]
S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda32v.sys [2009-06-26 66080]
S3 VMC302;Vimicro Camera Service VMC302;c:\windows\system32\Drivers\VMC302.sys [2009-01-23 243840]


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs REG_MULTI_SZ BthServ
LocalServiceAndNoImpersonation REG_MULTI_SZ FontCache

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 10:47 451872 ----a-w- c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
Contenu du dossier 'Tâches planifiées'

2010-09-03 c:\windows\Tasks\GlaryInitialize.job
- c:\program files\Glary Utilities\initialize.exe [2009-09-27 09:21]

2010-09-03 c:\windows\Tasks\User_Feed_Synchronization-{4FEB54DB-9D61-49A8-AB33-2D3870B644B6}.job
- c:\windows\system32\msfeedssync.exe [2010-08-11 04:24]
.
.
------- Examen supplémentaire -------
.
IE: E&xporter vers Microsoft Excel - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
TCP: {CD88DEB8-6213-4BF3-B673-FCD554128948} = 192.168.1.1,192.168.1.1
DPF: {9DF1C00D-8426-4337-972C-DC042D19A916} - hxxp://webtv.guidetv.orange.fr/resources/OCS_8971.cab
FF - ProfilePath - c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\j5i2jlzi.default\
FF - prefs.js: browser.startup.homepage - www.google.fr
FF - component: c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\j5i2jlzi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\components\qscanff.dll
FF - plugin: c:\program files\Google\Google Earth\plugin\npgeplugin.dll
FF - plugin: c:\program files\Java\jre6\bin\new_plugin\npdeployJava1.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nppl3260.dll
FF - plugin: c:\program files\K-Lite Codec Pack\Real\browser\plugins\nprpjplug.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\np-mswmp.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\NPDFusionWebFirefox.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptidfusionplugin.dll
FF - plugin: c:\program files\Mozilla Firefox\plugins\nptidfusionplugin.dll
FF - plugin: c:\program files\Total Immersion\DFusionHomeWebPlugIn\NPDFusionWebFirefox.dll
FF - plugin: c:\program files\Total Immersion\DFusionWeb\nptidfusionplugin.dll
FF - plugin: c:\users\kevin\AppData\Roaming\Facebook\npfbplugin_1_0_3.dll
FF - plugin: c:\users\kevin\AppData\Roaming\Mozilla\Firefox\Profiles\j5i2jlzi.default\extensions\{e001c731-5e37-4538-a5cb-8168736a2360}\plugins\npqscan.dll
FF - HiddenExtension: Microsoft .NET Framework Assistant: {20a82645-c095-46ed-80e3-08825760534b} - c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension\

---- PARAMETRES FIREFOX ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgbaam7a8h", true);
c:\program files\Mozilla Firefox\greprefs\all.js - pref("network.IDN.whitelist.xn--mgberp4a5d4ar", true);
c:\program files\Mozilla Firefox\defaults\pref\firefox.js - pref("dom.ipc.plugins.enabled", false);
.
- - - - ORPHELINS SUPPRIMES - - - -

MSConfigStartUp-Kernel and Hardware Abstraction Layer - KHALMNPR.EXE



**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2010-09-03 20:44
Windows 6.0.6002 Service Pack 2 NTFS

Recherche de processus cachés ...

Recherche d'éléments en démarrage automatique cachés ...

Recherche de fichiers cachés ...

Scan terminé avec succès
Fichiers cachés: 0

**************************************************************************
.
--------------------- DLLs chargées dans les processus actifs ---------------------

- - - - - - - > 'Explorer.exe'(1804)
c:\windows\system32\btncopy.dll
.
------------------------ Autres processus actifs ------------------------
.
c:\windows\system32\nvvsvc.exe
c:\program files\COMODO\COMODO Internet Security\cmdagent.exe
c:\windows\system32\rundll32.exe
c:\program files\Common Files\ArcSoft\Connection Service\Bin\ACService.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\COMMON~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\windows\servicing\TrustedInstaller.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\\?\c:\windows\system32\wbem\WMIADAP.EXE
.
**************************************************************************
.
Heure de fin: 2010-09-03 20:50:31 - La machine a redémarré
ComboFix-quarantined-files.txt 2010-09-03 18:50

Avant-CF: 40 427 712 512 octets libres
Après-CF: 40 093 474 816 octets libres

- - End Of File - - 73595A61D37674EA34FFBA51C95C5DC6

je post les log mais il ne reste pas....

j'ai poster le log.....mais il ne s'affiche pas.

Bonjour Virus-C-C

Désolé pour ce retard énorme, cause de travaille et pas de connexion internet.

-Udapte checker j'ai déja, je l'ouvre régulièrement et donc fais mes mise à jour des que possible.

-UsbFix j'ai aussi, j'ai déja vacciner mes disque amovible, je pourrais le re-faire pour vous envoyez un log mais ce soir je n'ai pas mon DD externe en question.

Je vais donc m'attacher Supress tools .

EDIT: j'ai Spybot pour anti spywar, j'ai cru entendre qu'il était devenu inutile. Est ce le cas ? j'ai télécharger Hitman Pro en échange.

Points de restau crée c'est bon.

1) * régle de sécurité :on réfléchit puis on clique et pas l'inverse
* Les fichiers/programmes c'est comme les bonbons, quand ça vient d'un inconnu, on n'accepte pas

Lol oui sa je sais ;)

Merci beaucoup pour tout, bien sympa de m'avoir accordé un peut de ton temps libre ;).

Bonne continuation !