Virus empeche acces internet

Résolu
tonio232 -  
Bonjour,

dans un premier tps je tiens à signaler que je ne m'y connais pas trop en informatique !

j'ai choper un virus hier windows retail
je ne pouvais plus rien faire, ni aller sur internet; ni consulter le moindre de mes fichiers !
je suis allé chez un amis pr consulter des forums sur le sujet et j'ai téléchargé 3, 4 logiciels mentionné dessus !

ensuite avec ces logiciels j'ai fait du grand n'importe quoi mais je suis parvenu par je ne sais quel miracle a retrouver mes fichiers grace à rogue killer je crois !!
probleme internet ne fonctionnais toujours pas !!

j'ai alors désinstalé avira car il me soulait il m'annonçais un virus toutes les 3 secondes pour finalement telecharger sur une clé usb avast !!
j'ai installer avast et une h d'analyse plus tard et malgré la suppression de 120 virus selon lui tjs le meme probleme, impossible d'aller sur internet ! puis avast fait comme avira, n'importe quoi !!

j'ai emprunté un pc pour retourner sur des forum j'ai telechargé ZPHFix et Diag mais maintenant meme ZPHFix refuse de demarer; une erreur d'application selon mon pc !!

je sais plus quoi faire, j'ai voulu jouer au grand mais la je dois bien reconnaitre que je suis totalement dépassé !!

quelqu'un pourrait il m'aider svp
je suis sous windows xp
merci
tony

37 réponses

Résumé de la discussion

Un utilisateur sous Windows XP signale une infection virale qui bloque Internet et l’accès aux fichiers après avoir téléchargé et exécuté des outils recommandés sur des forums. La discussion évoque RogueKiller et des perturbations causées par Avira et Avast, puis l’utilisation d’outils comme ZHPFix, DelFix et TDSSKiller pour nettoyer le système et rétablir l’accès Internet. Le fil met en avant le recours à des rapports de sécurité, comme GMER, et des bonnes pratiques pour éviter les infections futures, notamment sur les sites à éviter et les logiciels à privilégier. Des éléments techniques évoqués incluent un rapport GMER et l’indication de drivers Avast liés à la virtualisation, soulignant l’importance de logs et de sources officielles pour diagnostiquer les rootkits.

Bobot (l’IA à votre service)
  1. tonio232 Auteur
    # DelFix v7.6 - Rapport créé le 07/04/2011 à 12:39
    # Mis à jour le 31/03/11 à 16h par Xplode
    # Système d'exploitation : Microsoft Windows XP (32 bits) [version 5.1.2600] Service Pack 3
    # Nom d'utilisateur : Tony Bazin - SAMSUNG (Administrateur)
    # Exécuté depuis : C:\Documents and Settings\Tony Bazin\Bureau\DelFix.exe
    # Option [Suppression]

    ~~~~~~ Dossier(s) ~~~~~~

    -> C:\Qoobox\BackEnv ... ACL modifié avec succès.
    Supprimé : C:\Qoobox
    Supprimé : C:\ToolBar SD
    Supprimé : C:\Avenger
    Supprimé : C:\Program Files\ZHPDiag
    Supprimé : C:\Documents and Settings\All Users\Menu Démarrer\Programmes\ZHP

    ~~~~~~ Fichier(s) ~~~~~~

    Supprimé : C:\ComboFix.txt
    Supprimé : C:\rapport.txt
    Supprimé : C:\TB.txt
    Supprimé : C:\avenger.txt
    Supprimé : C:\TDSSKiller.2.4.21.0_01.04.2011_16.27.09_log.txt
    Supprimé : C:\PhysicalDisk0_MBR.bin
    Supprimé : C:\WINDOWS\grep.exe
    Supprimé : C:\WINDOWS\PEV.exe
    Supprimé : C:\WINDOWS\NIRCMD.exe
    Supprimé : C:\WINDOWS\MBR.exe
    Supprimé : C:\WINDOWS\sed.exe
    Supprimé : C:\WINDOWS\SWREG.exe
    Supprimé : C:\WINDOWS\SWSC.exe
    Supprimé : C:\WINDOWS\SWXCACLS.exe
    Supprimé : C:\WINDOWS\zip.exe
    Supprimé : C:\WINDOWS\System32\tmp.txt
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\ComboFix.exe
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\avenger.exe
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\avenger.zip
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\SystemLook.exe
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\SystemLook.txt
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\HiJackThis.exe
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\hijackthis.log
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\ZHPDiag.txt
    Supprimé : C:\Documents and Settings\Tony Bazin\Bureau\ZHPDiag2.exe
    Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPDiag.lnk
    Supprimé : C:\Documents and Settings\All Users\Bureau\ZHPFix.lnk
    Supprimé : C:\Documents and Settings\All Users\Bureau\MBRCheck.lnk

    ~~~~~~ Registre ~~~~~~

    Clé Supprimée : HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MenuOrder\Start Menu2\Programs\ZHP
    Clé Supprimée : HKLM\Software\swearware
    Clé Supprimée : HKLM\Software\Classes\.cfxxe
    Clé Supprimée : HKLM\Software\Classes\cfxxefile
    Clé Supprimée : HKLM\Software\TrendMicro\Hijackthis
    Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\Hijackthis
    Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\Uninstall\ZHPDiag_is1
    Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\HijackThis.exe
    Clé Supprimée : HKLM\Software\Microsoft\Windows\CurrentVersion\App Paths\combofix.exe

    ~~~~~~ Autre ~~~~~~

    -> Prefetch vidé

    ########## EOF - "C:\DelFixSuppr.txt" - [2836 octets] ##########

    Encore MERCI !!!!
    Tony
    1. Tigzy Contributeur sécurité
      ok pas de soucis ;)

      J'aurais juste une petite question, qu'est-ce qui faut que je fasse désormais et à l'avenir pour éviter ce genre de problème ?


      Comme toujours, éviter les sites à risque et le P2P...
      Mais bon, après c'est la loterie

      * Télécharge DELFix de Xplode
      * Lance le.
      * A l'invite, tape 2 (suppression)
      * Un rapport va s'ouvrir à la fin, colle le dans la réponse

      ----------

      Tu peux lire ce sujet sur les logiciels recommandés, et les attitudes responsables sur le web
      Et celui ci, sur les logiciels gratuits à éviter

      ------

      Tu peux garder Malwarebytes pour un scan de temps à autres

      -----

      Pense à marquer le fil comme résolu
      1. tonio232 Auteur
        Internet fonctionne de nouveau normalement ! Ce qui est déjà beaucoup pour moi car c'est ce à quoi me sert principalement ce PC !
        Avast a arrêté de péter son câble toutes les 2 minutes !! encore un truc cool !!

        Le seul problème qui demeure c'est que je ne peux plus accéder, par exemple, au contrôle du volume ou à la calculatrice, bref à certaines applications Windows. Mais outre le fait que ce n'est pas super grave, je pense surtout que c'est moi qui ai désinstallé ça lorsque j'ai tenté de régler ce problème par moi même !!

        Bref donc un grand merci à toi, c'est super cool ce que tu as fait pour moi, je dirais même que c'est trop de la balle !!

        J'aurais juste une petite question, qu'est-ce qui faut que je fasse désormais et à l'avenir pour éviter ce genre de problème ?
        Faut-il que je demande à Avast de faire un scan minutieux ?
        Ou alors que j'installe un autre anti-virus?
        Bref si tu as juste un petit conseil à me donner je suis preneur !!

        Encore merci mec !
        Tony
        4. Tigzy Contributeur sécurité
          bonne nouvelle, la clé F2 est partie!

          F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,

          J'ai l'impression que ça n'affiche pas tout avec ZHP...
          Tu peux me faire un log avec Hijack this?
          2. Tigzy Contributeur sécurité
            ok, refait un ZHPdiag

            Ensuite essaie de trouver un fichier qui ressemble à ça:

            C:\Program Files\RumYjUbK~ôg¨Ëybrwktml.exe\ybrwktml.exe

            et supprime le
            (Le chemin est bourré de caractères unicode, donc avenger a pas pu faire le boulot)

            1. tonio232 Auteur
              c'était super rapide !!
              voici le rapport de avenger :

              Logfile of The Avenger Version 2.0, (c) by Swandog46
              http://swandog46.geekstogo.com

              Platform: Windows XP

              *******************

              Script file opened successfully.
              Script file read successfully.

              Backups directory opened successfully at C:\Avenger

              *******************

              Beginning to process script file:

              Rootkit scan active.
              No rootkits found!

              File "C:\Documents and Settings\a\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe" deleted successfully.
              File "C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe" deleted successfully.
              File "C:\Program Files\quakaqgu\ybrwktml.exe" deleted successfully.

              Error: could not open file "C:\Program Files\RumYjUbK~ôg¨Ëybrwktml.exe\ybrwktml.exe"
              Deletion of file "C:\Program Files\RumYjUbK~ôg¨Ëybrwktml.exe\ybrwktml.exe" failed!
              Status: 0xc000003a (STATUS_OBJECT_PATH_NOT_FOUND)
              --> bad path / the parent directory does not exist

              File "C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe" deleted successfully.

              Completed script processing.

              *******************

              Finished! Terminate.
              1. Tigzy Contributeur sécurité
                ok, c'est un Zbot, on va tout péter :))
                http://www.virustotal.com/file-scan/report.html?id=0e896aab1b9e222cdc0978f0adb780fc5acfa492314eedc1ce9250bc1bdff029-1302023271

                Telecharge:

                The avenger

                * dezippe le , Lance le , executer en tant qu'administrateur sous vista

                capture

                Dans le cadre , sous Input Script here , copie_colle ce qui est en gras ci dessous et clic execute:


                Files to delete:
                C:\Documents and Settings\a\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe
                C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe
                C:\Program Files\quakaqgu\ybrwktml.exe
                C:\Program Files\RumYjUbK~ôg¨Ëybrwktml.exe\ybrwktml.exe
                C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe


                * Après le re-démarrage, il crée un fichier log qui s'ouvrira,que tu posteras dans ta prochaine reponse, faisant apparaitre les actions exécutées par The Avenger. Ce fichier log se trouve ici : C:\avenger.txt

                1. tonio232 Auteur
                  ok voici le rapport de SystemLook :

                  SystemLook 04.09.10 by jpshortstuff
                  Log created at 10:08 on 07/04/2011 by Tony Bazin
                  Administrator - Elevation successful

                  ========== filefind ==========

                  Searching for "ybrwktml.exe"
                  C:\Documents and Settings\a\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe ----s-- 158152 bytes [00:02 31/03/2011] [00:03 31/03/2011] D22C44525DACFFD850F75B082F18071E
                  C:\Documents and Settings\Administrateur\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe ------- 158152 bytes [08:53 31/03/2011] [12:42 31/03/2011] D22C44525DACFFD850F75B082F18071E
                  C:\Program Files\quakaqgu\ybrwktml.exe ------- 158152 bytes [22:12 31/03/2011] [13:06 01/04/2011] D22C44525DACFFD850F75B082F18071E
                  C:\Program Files\RumYjUbK~ôg¨Ëybrwktml.exe\ybrwktml.exe ------- 158152 bytes [22:57 30/03/2011] [12:42 31/03/2011] D22C44525DACFFD850F75B082F18071E
                  C:\WINDOWS\system32\config\systemprofile\Menu Démarrer\Programmes\Démarrage\ybrwktml.exe ----s-- 158152 bytes [09:26 31/03/2011] [13:20 31/03/2011] D22C44525DACFFD850F75B082F18071E

                  -= EOF =-
                  2. tonio232 Auteur
                    ok je vais arrêter mes conneries !

                    j'ai répété l'opération une dizaine de fois mais ces lignes suivantes refusent de partir :

                    O4 - S-1-5-18 Startup: ybrwktml.exe (User '?')
                    O4 - .DEFAULT Startup: ybrwktml.exe (User 'Default user')

                    merci
                    Tony
                    1. tonio232 Auteur
                      Je suis désolé je suis un peu chiant mais je trouve pas les lignes que tu m'annonces, j'ai lancé ComboFix hier soir car la dernière fois ça avait fait le ménage, du coup peut être que ça a supprimé certains trucs, je sais pas !!

                      voici le rapport de Hijack

                      Logfile of Trend Micro HijackThis v2.0.2
                      Scan saved at 20:07:41, on 06/04/2011
                      Platform: Windows XP SP3 (WinNT 5.01.2600)
                      MSIE: Unable to get Internet Explorer version!
                      Boot mode: Normal

                      Running processes:
                      C:\WINDOWS\System32\smss.exe
                      C:\WINDOWS\system32\winlogon.exe
                      C:\WINDOWS\system32\services.exe
                      C:\WINDOWS\system32\lsass.exe
                      C:\WINDOWS\system32\svchost.exe
                      C:\WINDOWS\System32\svchost.exe
                      C:\Program Files\AVAST Software\Avast\AvastSvc.exe
                      C:\WINDOWS\system32\spoolsv.exe
                      C:\Program Files\Java\jre6\bin\jqs.exe
                      C:\WINDOWS\Explorer.EXE
                      C:\WINDOWS\system32\svchost.exe
                      C:\Program Files\AVAST Software\Avast\avastUI.exe
                      C:\Program Files\Google\Chrome\Application\chrome.exe
                      C:\Program Files\Google\Chrome\Application\chrome.exe
                      C:\Program Files\Google\Chrome\Application\chrome.exe
                      C:\Program Files\Google\Chrome\Application\chrome.exe
                      C:\Program Files\Google\Chrome\Application\chrome.exe
                      C:\Documents and Settings\Tony Bazin\Bureau\HiJackThis.exe

                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
                      R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
                      R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
                      R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Liens
                      O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Fichiers communs\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
                      O2 - BHO: Increase performance and video formats for your HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
                      O2 - BHO: Use the DivX Plus Web Player to watch web videos with less interruptions and smoother playback on supported sites - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll
                      O2 - BHO: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
                      O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
                      O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
                      O3 - Toolbar: avast! WebRep - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files\AVAST Software\Avast\aswWebRepIE.dll
                      O4 - HKLM\..\Run: [avast] "C:\Program Files\AVAST Software\Avast\avastUI.exe" /nogui
                      O4 - S-1-5-21-2993286999-286281884-1603429676-1008 Startup: ybrwktml.exe (User '?')
                      O4 - S-1-5-18 Startup: ybrwktml.exe (User '?')
                      O4 - .DEFAULT Startup: ybrwktml.exe (User 'Default user')
                      O4 - Startup: ybrwktml.exe
                      O8 - Extra context menu item: E&xporter vers Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
                      O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
                      O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
                      O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
                      O23 - Service: avast! Antivirus - AVAST Software - C:\Program Files\AVAST Software\Avast\AvastSvc.exe
                      O23 - Service: Service Google Update (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
                      O23 - Service: InstallDriver Table Manager (IDriverT) - Unknown owner - C:\Program Files\Fichiers communs\InstallShield\Driver\11\Intel 32\IDriverT.exe (file missing)
                      O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
                      O23 - Service: MSCSPTISRV - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\MSCSPTISRV.exe (file missing)
                      O23 - Service: Distributed Transaction Coordinator (MSDTC) - Unknown owner - C:\WINDOWS\system32\msdtc.exe
                      O23 - Service: PACSPTISVR - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\PACSPTISVR.exe (file missing)
                      O23 - Service: Gestionnaire de session d'aide sur le Bureau à distance (RDSessMgr) - Unknown owner - C:\WINDOWS\system32\sessmgr.exe
                      O23 - Service: Samsung Update Plus - Unknown owner - C:\Program Files\Samsung\Samsung Update Plus\SLUBackgroundService.exe
                      O23 - Service: SNM WLAN Service - Unknown owner - C:\Program Files\samsung\Samsung Network Manager\SNMWLANService.exe (file missing)
                      O23 - Service: SonicStage Back-End Service - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SsBeSvc.exe
                      O23 - Service: Sony SPTI Service (SPTISRV) - Unknown owner - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SPTISRV.exe (file missing)
                      O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Fichiers communs\Sony Shared\AVLib\SSScsiSV.exe
                      O23 - Service: Carte de performance WMI (WmiApSrv) - Unknown owner - C:\WINDOWS\system32\wbem\wmiapsrv.exe
                      1. Tigzy Contributeur sécurité
                        ok, recommence avec Hijack this et fixe ces lignes:

                        O4 - S-1-5-21-2993286999-286281884-1603429676-1008 Startup: ybrwktml.exe (User '?')
                        O4 - S-1-5-18 Startup: ybrwktml.exe (User '?')
                        O4 - .DEFAULT Startup: ybrwktml.exe (User 'Default user')
                        O4 - Startup: ybrwktml.exe

                        Vérifie qu'elles sont parties

                        PS: Combofix n'est pas à utiliser sans avis!
                    2. Tigzy Contributeur sécurité
                      ok va faire autrement

                      Télécharger sur le bureau
                      Hijackthis

                      =Double-clic dessus
                      = Clic Do a system scan and save the log
                      = copier le rapport, le coller dans la réponse

                      Relancer Hijack this
                      = "Do a system scan only"
                      = cocher la ligne:
                      F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\Program Files\quakaqgu\ybrwktml.exe
                      = cliquer sur fix checked
                      = Relancer Hijack pour vérifier qu'elles sont parties.
                      1. Tigzy Contributeur sécurité
                        Je suis passé à côté d'une montagne :))

                        Relance ZHPDiag et relance un scan, un fois le scan fini clique sur le bouclier vert ZHPFix.
                        Ensuite clique sur le H "Coller les lignes Helper"
                        Copie colle ces lignes dans la fenêtre


                        F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\userinit.exe,,C:\Program Files\quakaqgu\ybrwktml.exe


                        Tu cliques ensuite sur "Tous" (ou tu coches la ligne), puis sur "Nettoyer"
                        ZHPFix va générer un rapport, envoie le pour vérification.

                        -----

                        Téléchargez SystemLook sur le Bureau à partir d'un des liens ci-dessous.
                        http://jpshortstuff.247fixes.com/SystemLook.exe
                        ou
                        http://images.malwareremoval.com/jpshortstuff/SystemLook.exe
                        * Double-cliquer sur SystemLook.exepour le lancer.
                        * Clic droit|Copier sur ce qui suit , et clic droit|Coller dans la zone texte de SystemLook :

                        :filefind
                        ybrwktml.exe

                        * Cliquer sur le bouton Look pour démarrer l'examen.
                        * le Bloc-notes s'ouvrira avec le résultat de l'analyse.
                        Copier-coller le rapport dans la prochaine réponse.

                        Note : Le rapport peut aussi être trouvé sur le Bureau sous le nom SystemLook.txt

                        1. tonio232 Auteur
                          je pensais avoir ajouté un commentaire hier mais je ne le vois plus !!
                          j'ai un problème ! je fais un scan avec ZHPDiag et aprés je clique sur le bouclier comme tu me l'indique mais je reçois aussitôt un message d'erreur qui me dit :

                          ZHPFix.exe erreur d'application
                          L'application n'a pas réussi à s'initialisé correctement (0xc0000022). Cliquez sur OK pour arrêter l'application.

                          j'ai essayé plein de trucs, réinstaller ZHPDiag et ZHPFix, avec ou sans l'antivirus etc ...
                          mais rien n'y fait !
                          que puis-je faire ?
                          merci
                          Tony
                      2. tonio232
                        ok pas de pb
                        le voici :
                        http://pjjoint.malekal.com/files.php?read=b8c13r6e1112c14v86w11
                        1. tonio232
                          ok ca va pas en fait !!
                          j'ai tapé sur internet héberger un fichier et je suis tomber sur trokus !
                          voici le lien !

                          http://www.trokus.fr/files/get/92o7hwLjy5/rapport.log

                          merci Tony
                          1. Tigzy Contributeur sécurité
                            ya trop de pubs, le flemme d'attendre
                            mets le ici plutôt : http://pjjoint.malekal.com/
                        2. tonio232
                          j'avoue que je comprend pas ce que tu dit par heberge le, donc j'ai refait un copié collé ! dsl !
                          Tony

                          GMER 1.0.15.15570 - http://www.gmer.net
                          Rootkit scan 2011-04-03 21:03:26
                          Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600BEVT-22ZCT0 rev.11.01A11
                          Running: gmer.exe; Driver: C:\DOCUME~1\TONYBA~1\LOCALS~1\Temp\pxddypoc.sys

                          ---- System - GMER 1.0.15 ----

                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xA9F959CA]
                          SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xA9FEAA68]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xA9FB5AF5]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xA9F97EAC]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xA9F97F04]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xA9F9801A]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xA9FB54A9]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xA9F97E02]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xA9F97F54]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xA9F97E56]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xA9F97FC8]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xA9F959EE]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xA9FB61BB]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xA9FB6471]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xA9F9829E]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xA9FB6026]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xA9FB5E91]
                          SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xA9FEAB18]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xA9F957B8]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xA9F95A12]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xA9F98412]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xA9F964AA]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xA9F97EDC]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xA9F97F2C]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xA9F98044]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xA9FB5805]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xA9F97E2E]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xA9F980D6]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xA9F97F94]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xA9F97E84]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xA9F981BA]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xA9F97FF2]
                          SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xA9FEABB0]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xA9FB5D0C]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xA9F96370]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xA9FB5B5E]
                          SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xA9FF2E26]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xA9FB4B1C]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xA9F95A36]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xA9F95A5A]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xA9F95812]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xA9F9594E]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xA9FB62C2]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xA9F9592A]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xA9F95972]
                          SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xA9F95A7E]

                          INT 0x62 ? 863D7BF8
                          INT 0x63 ? 861FBBF8
                          INT 0x73 ? 861FBBF8
                          INT 0x94 ? 861FBBF8
                          INT 0xB4 ? 861FBBF8

                          ---- Kernel code sections - GMER 1.0.15 ----

                          PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 805766FB 4 Bytes CALL A9F96E25 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
                          ? speg.sys Le fichier spécifié est introuvable. !
                          .text USBPORT.SYS!DllUnload F6BCE8AC 5 Bytes JMP 861FB1D8

                          ---- User code sections - GMER 1.0.15 ----

                          .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000D006C
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002F01D4
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002F00E4
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002F0120
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002F015C
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002F0198
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002F0030
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002F006C
                          .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002F00A8
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003000E4
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00300120
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003000A8
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00300030
                          .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0030006C
                          ? C:\WINDOWS\System32\smss.exe[508] time/date stamp mismatch;
                          ? C:\WINDOWS\system32\csrss.exe[560] time/date stamp mismatch; unknown module: CSRSRV.dll
                          .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\csrss.exe[560] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          ? C:\WINDOWS\system32\winlogon.exe[584] time/date stamp mismatch; unknown module: WINMM.dllunknown module: MSGINA.dllunknown module: RASAPI32.dllunknown module: MPR.dllunknown module: AUTHZ.dllunknown module: NDdeApi.dllunknown module: PROFMAP.dllunknown module: SETUPAPI.dllunknown module: VERSION.dllunknown module: WINSTA.dllunknown module: WINTRUST.dll
                          .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0007006C
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          ? C:\WINDOWS\system32\services.exe[628] time/date stamp mismatch; unknown module: NTDSAPI.dllunknown module: NCObjAPI.DLLunknown module: SCESRV.dllunknown module: umpnpmgr.dll
                          .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\services.exe[628] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          ? C:\WINDOWS\system32\svchost.exe[804] time/date stamp mismatch;
                          .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          ? C:\WINDOWS\system32\svchost.exe[852] time/date stamp mismatch;
                          .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          ? C:\WINDOWS\System32\svchost.exe[932] time/date stamp mismatch;
                          .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpOpenRequestA 77AB2B11 5 Bytes JMP 2004EB92
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetCloseHandle 77AB4DA4 5 Bytes JMP 2004E132
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetOpenUrlA 77AB5A72 5 Bytes JMP 2004EBEC
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestA 77AB60B9 5 Bytes JMP 2004E09E
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFile 77AB8302 5 Bytes JMP 2004EAD7
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestExW 77ABEA11 5 Bytes JMP 2004E012
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpOpenRequestW 77ABF45A 5 Bytes JMP 2004EBBF
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetOpenUrlW 77AC5BC2 5 Bytes JMP 2004EC13
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetQueryDataAvailable 77AC8A77 5 Bytes JMP 2004E7B8
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExW 77AE8679 5 Bytes JMP 2004E9BC
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetWriteFile 77AE8E39 5 Bytes JMP 2004E105
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExA 77AE9380 2 Bytes JMP 2004E915
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExA + 3 77AE9383 2 Bytes [56, A8]
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestW 77B03254 5 Bytes JMP 2004E0D3
                          .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestExA 77B03359 5 Bytes JMP 2004E058
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0019006C
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2001D423
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2001D74D
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2001DA66
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!send 719F4C27 5 Bytes JMP 2001D3D5
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2001D8AA
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!recv 719F676F 5 Bytes JMP 2001D6DE
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2001D7C2
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2001D985
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2001D833
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003D01D4
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003D00E4
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003D0120
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003D015C
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003D0198
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003D0030
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003D006C
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003D00A8
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003E00E4
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003E0120
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003E00A8
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003E0030
                          .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003E006C
                          ? C:\WINDOWS\system32\svchost.exe[1000] time/date stamp mismatch;
                          .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          ? C:\WINDOWS\system32\svchost.exe[1064] time/date stamp mismatch;
                          .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                          .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                          .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                          .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                          .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1256] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
                          ? C:\WINDOWS\system32\svchost.exe[1352] time/date stamp mismatch;
                          .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                          .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                          .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                          .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000D006C
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002F01D4
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002F00E4
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002F0120
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002F015C
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002F0198
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002F0030
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002F006C
                          .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002F00A8
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003000E4
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00300120
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003000A8
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00300030
                          .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0030006C
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000C006C
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003001D4
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003000E4
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 00300120
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 0030015C
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00300198
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 00300030
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 0030006C
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003000A8
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003100E4
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00310120
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003100A8
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00310030
                          .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0031006C
                          ? C:\WINDOWS\Explorer.EXE[1504] time/date stamp mismatch; unknown module: WINMM.dllunknown module: SETUPAPI.dllunknown module: WINSTA.dllunknown module: OLEACC.dllunknown module: BROWSEUI.dllunknown module: OLEAUT32.dllunknown module: SHDOCVW.dllunknown module: UxTheme.dll
                          .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                          .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                          .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                          .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                          .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002C01D4
                          .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002C00E4
                          .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002C0120
                          .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002C015C
                          .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfig2W
                          1. tonio232
                            si bien sûr !

                            GMER 1.0.15.15570 - http://www.gmer.net
                            Rootkit scan 2011-04-03 21:03:26
                            Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1600BEVT-22ZCT0 rev.11.01A11
                            Running: gmer.exe; Driver: C:\DOCUME~1\TONYBA~1\LOCALS~1\Temp\pxddypoc.sys

                            ---- System - GMER 1.0.15 ----

                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xA9F959CA]
                            SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xA9FEAA68]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xA9FB5AF5]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xA9F97EAC]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xA9F97F04]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xA9F9801A]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xA9FB54A9]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xA9F97E02]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xA9F97F54]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xA9F97E56]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xA9F97FC8]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xA9F959EE]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xA9FB61BB]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xA9FB6471]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xA9F9829E]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xA9FB6026]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xA9FB5E91]
                            SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xA9FEAB18]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xA9F957B8]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xA9F95A12]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xA9F98412]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xA9F964AA]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xA9F97EDC]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xA9F97F2C]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xA9F98044]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xA9FB5805]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xA9F97E2E]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xA9F980D6]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xA9F97F94]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xA9F97E84]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xA9F981BA]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xA9F97FF2]
                            SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xA9FEABB0]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xA9FB5D0C]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xA9F96370]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xA9FB5B5E]
                            SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xA9FF2E26]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xA9FB4B1C]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xA9F95A36]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xA9F95A5A]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xA9F95812]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xA9F9594E]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xA9FB62C2]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xA9F9592A]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xA9F95972]
                            SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xA9F95A7E]

                            INT 0x62 ? 863D7BF8
                            INT 0x63 ? 861FBBF8
                            INT 0x73 ? 861FBBF8
                            INT 0x94 ? 861FBBF8
                            INT 0xB4 ? 861FBBF8

                            ---- Kernel code sections - GMER 1.0.15 ----

                            PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 805766FB 4 Bytes CALL A9F96E25 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
                            ? speg.sys Le fichier spécifié est introuvable. !
                            .text USBPORT.SYS!DllUnload F6BCE8AC 5 Bytes JMP 861FB1D8

                            ---- User code sections - GMER 1.0.15 ----

                            .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000D006C
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002F01D4
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002F00E4
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002F0120
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002F015C
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002F0198
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002F0030
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002F006C
                            .text C:\WINDOWS\system32\spoolsv.exe[440] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002F00A8
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003000E4
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00300120
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003000A8
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00300030
                            .text C:\WINDOWS\system32\spoolsv.exe[440] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0030006C
                            ? C:\WINDOWS\System32\smss.exe[508] time/date stamp mismatch;
                            ? C:\WINDOWS\system32\csrss.exe[560] time/date stamp mismatch; unknown module: CSRSRV.dll
                            .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\csrss.exe[560] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\csrss.exe[560] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            ? C:\WINDOWS\system32\winlogon.exe[584] time/date stamp mismatch; unknown module: WINMM.dllunknown module: MSGINA.dllunknown module: RASAPI32.dllunknown module: MPR.dllunknown module: AUTHZ.dllunknown module: NDdeApi.dllunknown module: PROFMAP.dllunknown module: SETUPAPI.dllunknown module: VERSION.dllunknown module: WINSTA.dllunknown module: WINTRUST.dll
                            .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\winlogon.exe[584] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0007006C
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\winlogon.exe[584] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\winlogon.exe[584] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\winlogon.exe[584] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            ? C:\WINDOWS\system32\services.exe[628] time/date stamp mismatch; unknown module: NTDSAPI.dllunknown module: NCObjAPI.DLLunknown module: SCESRV.dllunknown module: umpnpmgr.dll
                            .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\services.exe[628] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\services.exe[628] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\services.exe[628] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\services.exe[628] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\lsass.exe[640] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\lsass.exe[640] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\lsass.exe[640] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\lsass.exe[640] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            ? C:\WINDOWS\system32\svchost.exe[804] time/date stamp mismatch;
                            .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\svchost.exe[804] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\svchost.exe[804] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\svchost.exe[804] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\svchost.exe[804] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            ? C:\WINDOWS\system32\svchost.exe[852] time/date stamp mismatch;
                            .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\svchost.exe[852] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\svchost.exe[852] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\svchost.exe[852] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\svchost.exe[852] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            ? C:\WINDOWS\System32\svchost.exe[932] time/date stamp mismatch;
                            .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\System32\svchost.exe[932] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\System32\svchost.exe[932] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\System32\svchost.exe[932] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\System32\svchost.exe[932] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpOpenRequestA 77AB2B11 5 Bytes JMP 2004EB92
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetCloseHandle 77AB4DA4 5 Bytes JMP 2004E132
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetOpenUrlA 77AB5A72 5 Bytes JMP 2004EBEC
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestA 77AB60B9 5 Bytes JMP 2004E09E
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFile 77AB8302 5 Bytes JMP 2004EAD7
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestExW 77ABEA11 5 Bytes JMP 2004E012
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpOpenRequestW 77ABF45A 5 Bytes JMP 2004EBBF
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetOpenUrlW 77AC5BC2 5 Bytes JMP 2004EC13
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetQueryDataAvailable 77AC8A77 5 Bytes JMP 2004E7B8
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExW 77AE8679 5 Bytes JMP 2004E9BC
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetWriteFile 77AE8E39 5 Bytes JMP 2004E105
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExA 77AE9380 2 Bytes JMP 2004E915
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!InternetReadFileExA + 3 77AE9383 2 Bytes [56, A8]
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestW 77B03254 5 Bytes JMP 2004E0D3
                            .text C:\WINDOWS\System32\svchost.exe[932] WININET.dll!HttpSendRequestExA 77B03359 5 Bytes JMP 2004E058
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0019006C
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2001D423
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2001D74D
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2001DA66
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!send 719F4C27 5 Bytes JMP 2001D3D5
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2001D8AA
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!recv 719F676F 5 Bytes JMP 2001D6DE
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2001D7C2
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2001D985
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2001D833
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003D01D4
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003D00E4
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003D0120
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003D015C
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003D0198
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003D0030
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003D006C
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003D00A8
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003E00E4
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003E0120
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003E00A8
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003E0030
                            .text C:\Program Files\Java\jre6\bin\jqs.exe[980] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003E006C
                            ? C:\WINDOWS\system32\svchost.exe[1000] time/date stamp mismatch;
                            .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\svchost.exe[1000] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\svchost.exe[1000] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\svchost.exe[1000] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\svchost.exe[1000] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            ? C:\WINDOWS\system32\svchost.exe[1064] time/date stamp mismatch;
                            .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\system32\svchost.exe[1064] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002B01D4
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002B00E4
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002B0120
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002B015C
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002B0198
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002B0030
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002B006C
                            .text C:\WINDOWS\system32\svchost.exe[1064] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002B00A8
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2004C9AD
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C00A8
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C0030
                            .text C:\WINDOWS\system32\svchost.exe[1064] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C006C
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!sendto 719F2F51 5 Bytes JMP 2004D423
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!recvfrom 719F2FF7 5 Bytes JMP 2004D74D
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!closesocket 719F3E2B 5 Bytes JMP 2004DA66
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!send 719F4C27 5 Bytes JMP 2004D3D5
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSARecv 719F4CB5 5 Bytes JMP 2004D8AA
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!recv 719F676F 5 Bytes JMP 2004D6DE
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSASend 719F68FA 5 Bytes JMP 2004D7C2
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSARecvFrom 719FF66A 5 Bytes JMP 2004D985
                            .text C:\WINDOWS\system32\svchost.exe[1064] WS2_32.dll!WSASendTo 71A00AAD 5 Bytes JMP 2004D833
                            .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1256] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
                            ? C:\WINDOWS\system32\svchost.exe[1352] time/date stamp mismatch;
                            .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                            .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                            .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                            .text C:\WINDOWS\system32\svchost.exe[1352] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000D006C
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002F01D4
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002F00E4
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002F0120
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002F015C
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002F0198
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002F0030
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002F006C
                            .text C:\WINDOWS\system32\svchost.exe[1352] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002F00A8
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003000E4
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00300120
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003000A8
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00300030
                            .text C:\WINDOWS\system32\svchost.exe[1352] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0030006C
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2001FF3F
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20017A40
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2001FDBB
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000C006C
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003001D4
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003000E4
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 00300120
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 0030015C
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00300198
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 00300030
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 0030006C
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003000A8
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!TranslateMessage 7E398BF6 5 Bytes JMP 2001C9AD
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003100E4
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00310120
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003100A8
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 00310030
                            .text C:\WINDOWS\system32\wdfmgr.exe[1440] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 0031006C
                            ? C:\WINDOWS\Explorer.EXE[1504] time/date stamp mismatch; unknown module: WINMM.dllunknown module: SETUPAPI.dllunknown module: WINSTA.dllunknown module: OLEACC.dllunknown module: BROWSEUI.dllunknown module: OLEAUT32.dllunknown module: SHDOCVW.dllunknown module: UxTheme.dll
                            .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!NtQueryDirectoryFile 7C91D76E 5 Bytes JMP 2004FF3F
                            .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!NtResumeThread 7C91DB3E 5 Bytes JMP 20047A40
                            .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 2004FDBB
                            .text C:\WINDOWS\Explorer.EXE[1504] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 0009006C
                            .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002C01D4
                            .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002C00E4
                            .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002C0120
                            .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002C015C
                            .text C:\WINDOWS\Explorer.EXE[1504] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002C0198
                            .text C:\WINDOWS\Explorer.E
                            1. Tigzy Contributeur sécurité
                              il manque un bout, heberge le, mais dans un .txt (bloc note)
                          • 1
                          • 2

                          Discussions similaires

                          FOTOSE (allemagne)
                          lix

                          13 réponses
                          Message "Un bloqueur de publicité empêche la lecture..."
                          pistouri

                          0 réponse
                          ATTENTION : escroquerie à la carte bleue !!
                          dvrg

                          80 réponses
                          comment desactiver un bloqueur de pub
                          amour10

                          4 réponses
                          developement fotos!!
                          dédé

                          2 réponses