VIRUS PHYSICAL DRIVE

merci beaucoup !

et 1.5 Go de gagnés ^^

C:\WINDOWS\system32\wbem\Logs\FrameWork.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\mofcomp.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\wbemcore.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\wbemess.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\wbemess.lo_ <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\wbemprox.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\WinMgmt.log <- Successfully deleted.
C:\WINDOWS\system32\wbem\Logs\wmiprov.log <- Successfully deleted.
C:\Documents and Settings\Administrateur\Local Settings\Application Data\IconCache.db <- Successfully deleted.
C:\Documents and Settings\All Users\Application Data\Photo Notifier and Animation Creator\templates\animations\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\Default User\Local Settings\Application Data\IconCache.db <- Successfully deleted.
C:\Documents and Settings\deprez\Bureau\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Bureau\curseurs\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Bureau\FOTO DIVERS\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Bureau\ICONES BUREAU\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IconCache.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\11\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\15\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\19\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\2\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\20\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\IM\Identities\{2250111D-9D25-42B7-8204-A6227124F3C8}\IMSys\{781B9B29-76A7-423F-A038-5BB34D4F48FA}\3\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Local Settings\Application Data\Productivity_2.2\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Mes documents\Mes images\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Mes documents\Mes images\chambre\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Mes documents\Mes images\PARIS 2010\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\deprez\Mes documents\Téléchargements\Thumbs.db <- Successfully deleted.
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Portable Devices\wpdlog00.sqm <- Successfully deleted.
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Portable Devices\wpdlog01.sqm <- Successfully deleted.
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Portable Devices\wpdlog02.sqm <- Successfully deleted.
C:\ForceMove\Quarantine\ConduitEngine.FM\Dialogs\ToolbarFirstTimeDialog\images\Thumbs.db <- Successfully deleted.
C:\Program Files\eMule\Incoming\Thumbs.db <- Successfully deleted.
C:\Program Files\eMule\Incoming\film ben\Thumbs.db <- Successfully deleted.
C:\Program Files\eMule\Incoming\film celine\Thumbs.db <- Successfully deleted.
C:\Program Files\eMule\Incoming\film celine\lolol\Thumbs.db <- Successfully deleted.
C:\Program Files\eMule\Incoming\true blood\Thumbs.db <- Successfully deleted.
C:\Program Files\PhotoFiltre\Masks\Thumbs.db <- Successfully deleted.
C:\Program Files\PhotoFiltre\Patterns\Thumbs.db <- Successfully deleted.
C:\VALUEADD\Thumbs.db <- Successfully deleted.
C:\WINDOWS\Thumbs.db <- Successfully deleted.
C:\WINDOWS\system32\config\systemprofile\Local Settings\Application Data\IconCache.db <- Successfully deleted.

Total space cleaned: 1407410063 bytes

-=E.O.F=-

Total space cleaned: 1407410063 bytes

je reste sceptique quand au fait qu'il soit parti mais si avast dit plus rien.....

Pour nettoyer les outils utilsés et mieux sécuriser ton pc
--------------------------------------------------------------

Je t'invite à suivre ce tutoriel pour le final

il inclut

♦ du nettoyage après desinfection
♦ des mises à jour pour combler des failles de securité de logiciels importants non mis à jour

▶ et enfin quelques conseils à suivre afin que la protection soit plus efficace

_________________________________________________

Telecharge ici : PureRa (par l'editeur de JavaRa)

Lance-le (clic droit "executer en tant qu'administrateur" pour Vista/7)

=> Configuration

clique sur "Clean"

L'outil va faire son scan puis son nettoyage

à la fin du rapport tu auras une ligne comme ca :

Total space cleaned: 8140878 bytes

transmets juste cette ligne , le reste importe peu

__________________________________________________

Si nous avons utilisé Defogger et cliqué sur "disable" , tu peux le "reenable"

__________________________________________________

▶ Télécharge DelFix sur ton bureau.

▶ Lance le, tape suppression puis valide

Patiente pendant le scan jusqu'à l'ouverture du rapport.

▶ Copie/Colle le contenu du rapport dans ta prochaine réponse.

Note : Le rapport se trouve également sous C:\DelFix.txt

tu peux le desinstaller

___________________________________________________

▶ Télécharge :ATF Cleaner par Atribune

Ferme tous tes navigateurs

Double-clique (clic droit "en tant qu'administrateur" pour Vista) ATF-Cleaner.exe afin de lancer le programme.
Sous l'onglet Main, choisis : Select All
Clique sur le bouton Empty Selected
Si tu utilises le navigateur Firefox :
Clique Firefox au haut et choisis : Select All
Clique le bouton Empty Selected a
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité.
Si tu utilises le navigateur Opera :
Clique Opera au haut et choisis : Select All
Clique le bouton Empty Selected
NOTE : Si tu veux conserver tes mots de passe sauvegardés, clique No à l'invité.
Clique Exit, du menu prinicipal, afin de fermer le programme.
Pour obtenir du Support technique, double-clique l'adresse électronique située au bas de chacun des menus.
__________________________________________________

▶ Tu peux garder ATF pour d'eventuels nettoyages un peu plus poussés
__________________________________________________

▶ Télécharge et installe CCleaner (N'installe pas la Yahoo Toolbar) :

* Lance-le.(clic droit "en tant qu'administrateur" pour Vista)

=> Configuration

fais le nettoyage dans le registre et dans le nettoyeur autant de fois qu'il trouve des choses à l analyse
__________________________________________________

Attention : ne pas toucher au PC pendant qu'il travaille !

▶ Nettoyage et Défragmentation de tes Disques

*Nettoyage :

Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Général"
Cliques sur le bouton "nettoyage de disque", OK
tu le fais pour chacun de tes disques
________________________________________________

*Vérifications des erreurs :

Clic droit sur "poste de travail"(ordinateur pour vista) ==>"ouvrir" ==>clic droit sur le disque C ==>Propriétés ==>onglet "Outil"
"Vérifier maintenant", une boîte s'ouvre, cocher les cases :
-réparer automatiquement les erreurs...
-rechercher et tenter une récupération...

--->Démarrer, ok
Note : s'il te dis de redémarrer ton Pc pour le faire , tu redémarres et tu laisses faire, cela prend un peu de temps c'est normal
tu le fais pour chacun de tes disques
________________________________________________

ensuite toujours dans le même onglet tu choisis :

*Défragmentation :
"défragmenter maintenant", OK
une boîte s'ouvre, tu sélectionnes le disque à défragmenter, et tu cliques sur "analyser", puis après l'analyse, "défragmenter" . OK
tu le fais pour chacun de tes disques
_______________________________________________

Note : si tu as un utilitaire pour défragmenter , utilises le à la place

pour ce faire Defraggler est proposé
_________________________________________________

▶ Peux-tu vérifier ta Console Java ? :

et installer la nouvelle version si besoin est (dans ce cas désinstalle avant l'ancienne version).

voici pour desinstaller :

JavaRa

Décompresse le fichier sur le Bureau (Clic droit > Extraire tout).
* Double-clique (clic droit "en tant qu'administrateur" pour Vista) sur le répertoire JavaRa.
* Puis double-clique sur le fichier JavaRa.exe (le exe peut ne pas s'afficher).
* Choisis Français puis clique sur Select.
* Clique sur Recherche de mises à jour.
* Sélectionne Mettre à jour via jucheck.exe puis clique sur Rechercher.
* Autorise le processus à se connecter s'il le demande, clique sur Installer et suis les instructions d'installation qui prennent quelques minutes.
* L'installation est terminée, reviens à l'écran de JavaRa et clique sur Effacer les anciennes versions.
* Clique sur Oui pour confirmer. Laisse travailler et clique ensuite sur OK, puis une deuxième fois sur OK.
* Un rapport va s'ouvrir. Poste-le dans ta prochaine réponse.
* Ferme l'application.

Note : le rapport se trouve aussi dans C:\ sous le nom JavaRa.log.
_________________________________________________

▶ Mets à jour Adobe Reader si ce n'est pas le cas (désinstalle avant la version antérieure)

et pense à decocher l'installation de McAfee proposée discrêtement
__________________________________________________

▶ Je te conseille si tu n en as pas , afin de mieux securiser ton pc , d'installer un parefeu :

Online armor ou KERIO ou JETICO ou ZONE ALARM (mettre que le parefeu gratuit) ou COMODO

https://www.commentcamarche.net/telecharger/securite/16545-online-armor-personal-firewall/
https://www.01net.com/telecharger/windows/Securite/firewall/fiches/39911.html
https://forum.pcastuces.com/sujet.asp?f=25&s=35606
https://www.clubic.com/telecharger-fiche11071-sunbelt-personal-firewall-ex-kerio.html
https://manuelsdaide.com/contact/
http://www.open-files.com/forum/index.php?showtopic=29277
https://www.commentcamarche.net/telecharger/securite/24863-zonealarm/
___________________________________________________

▶ Tu peux aussi vider ta corbeille,quoi que Ccleaner le fasse tout seul
_____________________________________________________

▶ Si nous avons utilisé MalwareByte's Anti-Malware , vide sa quarantaine :

* Lance le programme puis clique sur <Quarantaine>.
* Sélectionne tous les éléments puis clique sur <supprimer>.
* Quitte le programme.
______________________________________________________

▶ si tu as installé Antivir :

Configuration
________________________________________________________

▶ Idem pour ton antivirus : vide sa quarantaine si ce n'est pas déjà fait
______________________________________________________

▶ Désactive et réactive la restauration de système, pour cela : suis les instructions du lien :

Lien XP

Lien Vista

▶ Sitôt fait , recrées un point de restoration dit "sain" pour parer à quelques eventuels problêmes dans le futur

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

Quelques conseils et recommandations pour l'avenir :

▶ Passe un coup de MalwareByte's Anti-Malware de temps en temps (1 fois par semaine , suivant l'utilisation que tu fais de ton PC.
▶ Utilise aussi tes autres logiciels de protection (scannes antivirus, antispywares...). N'oublie pas de faire les mises à jour avant de les utiliser.
* Pense aussi à faire une défragmentation de tes disques durs de temps en temps (garde suffisamment d'espace sur C:\ (1/3 de libre pour être à l'aise))
_____________

▶ Pour bien protéger ton PC :
[1 seul Antivirus] + [1 seul Pare feu] + [Un bon Antispyware] + [Mises à Jour récentes Windows et Logiciels de Protection] + [Utilisation de Firefox -ou autres- (Internet Explorer présente des failles de sécurité qui mettent longtemps avant d'être corrigées mais il faut absolument le conserver pour les mises à jour Windows et Windows live Messenger)]

Je te conseille d'installer cette extension pour Firefox pour securiser ton surf : WOT
Je te conseille d'installer cette extension pour Internet Explorer pour securiser ton surf : WOT

PS : En fait la meilleure des protections c'est toi même : ce que tu fais avec ton PC : où tu surfes, télécharges...ect....
Les virus utilisent les failles de ton PC pour infecter un système
à lire aussi
Et ceci

▶ dans le souhait de vouloir desinstaller un antivirus au profit d'un autre , voici quelques liens :

Desinstaller Avast
Desinstaller BitDefender
Desinstaller Norton
Desinstaller Kaspersky
Desinstaller AVG

ou tout en un :

Désinstallation Antivirus , Parefeu , Antispyware
_____________

▶ Si tu as Vista n'oublie pas de réactiver le controle des comptes des utilisateurs(UAC)
___________

▶ si nous avons affiché les fichiers cachés , n'oublies pas de les remettre en attribut "caché"

▶ Clique sur le menu Demarrer /Panneau de configuration/Options des dossiers/ puis dans l'onglet Affichage
* - Décoche Afficher les fichiers et dossiers cachés
* - coche Masquer les extensions des fichiers dont le type est connu
* - coche Masquer les fichiers protégés du système d'exploitation (recommandé)

▶ clique sur Appliquer, puis OK.
____________

Voila,

Bonne lecture, à bientot , une fois tout ceci fait,

tu peux mettre le topic en resolu

Bonne continuation et surtout , prudence et bon surf :)

non aucun !! ts va bien !! ça veu dir ke cest bon on a fini ???
en ts cas merci beaucoup

hello toujours des avertissements d'aVast ?

.text C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[3952] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003A0C0C
.text C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[3952] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003A0E10
.text C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[3952] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003A01F8
.text C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[3952] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003A03FC
.text C:\Program Files\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe[3952] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003A0600
.text C:\Documents and Settings\deprez\Local Settings\Temporary Internet Files\Content.IE5\QBE5J0VA\gmer[1].exe[3988] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Documents and Settings\deprez\Local Settings\Temporary Internet Files\Content.IE5\QBE5J0VA\gmer[1].exe[3988] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\WINDOWS\system32\services.exe[1324] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 005E0002
IAT C:\WINDOWS\system32\services.exe[1324] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 005E0000

---- Devices - GMER 1.0.15 ----

Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)

AttachedDevice \FileSystem\Ntfs \Ntfs aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Ntfs \Ntfs psdfilter.sys (PSD Filter Driver/HiTRUST)
AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice \FileSystem\Fastfat \Fat aswMon2.SYS (avast! File System Filter Driver for Windows XP/AVAST Software)
AttachedDevice \FileSystem\Fastfat \Fat psdfilter.sys (PSD Filter Driver/HiTRUST)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System
Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG12.00.00.01PROFESSIONAL 8CA25B5C4732B7A88D4AE98A691B244981644C0B32797A144D47F89441BA190D8939E1792A81FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C5D575E7D6A3B9808BA7FD869164D6794A6A0AC4980AC79339DB7CE019D40AA5CC2B150ED21BE7E7A04A23DC14AF10878B7812627CA4C15C485D47744D347AE00D966AD28B6069F92A08D639963D50F631157EBBD84F4226A866E068C1B273809E962179431A1AA3A32B67D129EC428096440EA4F5BA19CE4395A565CDED12039C0E2F792972585589C8D58E6EA156DBED183F015448D6C1817D4D60ABE89401FCB37FD32D1F69DCC6B97838896F1794E98FA8D7A99CBFE59B92DBA1F3D64F9BF21C49EBD2BD1E0E5C9EED399595B6FF6219317201BBF4874DF46F55AC24AAC14F6828FABD445C46A8840E0F04C2672E8F352A5DBE922BCA7EC18442A1AFAC10629FCCBADE2323F921D4C871CEBF82B4B3E4A18B48DFE55A7E6AC2337F207A1F639D614A4CD504D0C20E9E7D89AD047B7D3288D67EEB9111AF92455D86055BCBA4A41E8A8722BEE774E01E41B9D7BF5BC2A296CE55E84EF9BF3B1DF9D5A9E051AA384938110212669090F280B1D1EECDC5AA05ED20DE979B8481D0E47BB71EFCFB1001F304DE3FBEAD5251D04A830E38C22724F8791C5B6F60FC0ECCA452E7B8C84A05AE6307CFA7ADBE

---- Files - GMER 1.0.15 ----

File C:\## aswSnx private storage 0 bytes
File C:\## aswSnx private storage\snx_rhive 262144 bytes
File C:\## aswSnx private storage\snx_rhive.LOG 1024 bytes
File C:\## aswSnx private storage\webStorage 0 bytes
File C:\## aswSnx private storage\webStorage\attrib 0 bytes
File C:\## aswSnx private storage\webStorage\image 0 bytes
File C:\## aswSnx private storage\webStorage\snx_fs.dat 180 bytes

---- EOF - GMER 1.0.15 ----

mets les 30 dernieres lignes du rapport ici

jvien de reessayer avec une copie !sa march tjr pa !! non mais tes sur kil fau fair ts ça ??mon ordi se porte comme un charme !il va super bien c cool en tous cas tu ma bien aidé jte remercie enormement de m'avoir consacré beaucoup de temps si on est obligé de continuer bah fait moi signe sinon merci a toi tu es un super antibiotique
merci amicalement
céline ...??

non cest une blague ? est se ke je fai tous simplement une copie du racourcie et je met cell ci sur cijoint !??

comment je fai pr fair une copie dans un nouveau doc texte ?? je fait ça avc open office ??? jsui nul en traitement de texte !

ok copie le contenu dans un nouveau document texte et poste celui-ci

a wé ok jetai pa sur le bon site jme suis retrouvé sur un site orange enfin bref jvien d'essayer les fichiers avec extension log ne peuvent pa etr déposé !!
jai plu le temps jpar au taf juska 20 h !! :-(
a ce soir peut etr
merci!

comme tu as fait ici

https://forums.commentcamarche.net/forum/affich-21997992-virus-physical-drive?full#28

tu l'a pa entierement ?? et ya pa un autre moyen ??? parce que jcompren rien sur cijoint.fr !!!!:-((

il faudrait que tu me le fasses passer via cijoint.fr il est trop long :)

GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-04 22:48:35
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST3250820AS rev.3.AAD
Running: gmer[1].exe; Driver: C:\DOCUME~1\deprez\LOCALS~1\Temp\uwxdqpog.sys

---- System - GMER 1.0.15 ----

SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xA9F11202]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xA9F77C48]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xA9F356A1]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xA9F137F0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xA9F13848]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xA9F1395E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xA9F35055]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xA9F13746]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xA9F13898]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xA9F1379A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xA9F1390C]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xA9F11226]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xA9F35D67]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xA9F3601D]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xA9F13BE2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xA9F35BD2]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xA9F35A3D]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xA9F77CF8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xA9F10FF0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xA9F1124A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xA9F13D56]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xA9F11CDA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xA9F13820]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xA9F13870]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xA9F13988]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xA9F353B1]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xA9F13772]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xA9F13A1A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xA9F138D8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xA9F137C8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xA9F13AFE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xA9F13936]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xA9F77D90]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xA9F358B8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xA9F11BA0]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xA9F3570A]
SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xA9F80CAE]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xA9F346C8]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xA9F1126E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xA9F11292]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xA9F1104A]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xA9F11186]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xA9F35E6E]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xA9F11162]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xA9F111AA]
SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xA9F112B6]

Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xA9F8D762]
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject

---- Kernel code sections - GMER 1.0.15 ----

PAGE TUKERNEL.EXE!ObInsertObject 8056DA64 5 Bytes JMP A9F8ABBC \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE TUKERNEL.EXE!PsCreateSystemThread + 455 805766FB 4 Bytes CALL A9F12335 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
PAGE TUKERNEL.EXE!SeQueryInformationToken + A0C 8058B9EC 7 Bytes JMP A9F8D766 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE TUKERNEL.EXE!ObMakeTemporaryObject 805AD1E0 5 Bytes JMP A9F8911E \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text win32k.sys!EngFreeUserMem + 674 BF80996D 5 Bytes JMP A9F14CA2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngDeleteSurface + 45 BF81395C 5 Bytes JMP A9F14BAE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngSetLastError + 7690 BF823FF7 5 Bytes JMP A9F13F34 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngPaint + 118C2 BF839930 5 Bytes JMP A9F14180 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngPaint + 1194D BF8399BB 5 Bytes JMP A9F14326 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!XLATEOBJ_iXlate + 33C8 BF83D961 5 Bytes JMP A9F13E70 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + 698 BF847820 5 Bytes JMP A9F14E0C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateBitmap + 3A66 BF84ABEE 5 Bytes JMP A9F15014 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngTextOut + 1DB5 BF85352E 5 Bytes JMP A9F14B1E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngStretchBlt + 3629 BF8578AB 5 Bytes JMP A9F13E58 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngStretchBlt + A0E7 BF85E369 5 Bytes JMP A9F14BD8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngUnicodeToMultiByteN + 2ED7 BF861C8A 5 Bytes JMP A9F14F72 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngGetCurrentCodePage + 411E BF87C6BE 5 Bytes JMP A9F142FE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!FONTOBJ_pxoGetXform + 9219 BF8B0165 5 Bytes JMP A9F13FA4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreatePalette + ABB BF8B9773 5 Bytes JMP A9F14D54 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngAlphaBlend + 4CA2 BF8C3290 5 Bytes JMP A9F1403E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngFillPath + 1517 BF8EB8E7 5 Bytes JMP A9F140AE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngFillPath + 1797 BF8EBB67 5 Bytes JMP A9F140E8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!PATHOBJ_bCloseFigure + 19EF BF8F99C1 5 Bytes JMP A9F13D8C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 1A0A BF913BA8 5 Bytes JMP A9F13EF0 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 25DE BF91477C 5 Bytes JMP A9F14008 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngCreateClip + 4F3D BF9170DB 5 Bytes JMP A9F14440 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
.text win32k.sys!EngPlgBlt + 190E BF9454A3 5 Bytes JMP A9F14ECA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)

---- User code sections - GMER 1.0.15 ----

.text C:\WINDOWS\system32\Ati2evxx.exe[176] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001401F8
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001403FC
.text C:\WINDOWS\system32\Ati2evxx.exe[176] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\WINDOWS\system32\Ati2evxx.exe[176] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 00380804
.text C:\WINDOWS\system32\Ati2evxx.exe[176] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00380A08
.text C:\WINDOWS\system32\Ati2evxx.exe[176] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 00380600
.text C:\WINDOWS\system32\Ati2evxx.exe[176] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003801F8
.text C:\WINDOWS\system32\Ati2evxx.exe[176] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003803FC
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 3 Bytes JMP 00391014
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!SetServiceObjectSecurity + 4 77E06D85 1 Byte [88]
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 00390804
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 00390A08
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 00390C0C
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00390E10
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003901F8
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003903FC
.text C:\WINDOWS\system32\Ati2evxx.exe[176] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 00390600
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 00581014
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 00580804
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 00580A08
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 00580C0C
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00580E10
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 005801F8
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 005803FC
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 00580600
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 00590804
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00590A08
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 00590600
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 005901F8
.text C:\Program Files\IncrediMail\Bin\IncMail.exe[196] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 005903FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001501F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001503FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003B1014
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003B0804
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003B0A08
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003B0C0C
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003B0E10
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003B01F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003B03FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003B0600
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003C0804
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003C0A08
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003C0600
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003C01F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!UnhookWinEvent 7E3B18AC 3 Bytes JMP 003C03FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe[324] USER32.dll!UnhookWinEvent + 4 7E3B18B0 1 Byte [82]
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[524] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[524] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 4 Bytes [C2, 04, 00, 90] {RET 0x4; NOP }
.text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[524] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 000901F8
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\Explorer.EXE[744] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000903FC
.text C:\WINDOWS\Explorer.EXE[744] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002C1014
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002C0804
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002C0A08
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002C0C0C
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002C0E10
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002C01F8
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002C03FC
.text C:\WINDOWS\Explorer.EXE[744] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002C0600
.text C:\WINDOWS\Explorer.EXE[744] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002D0804
.text C:\WINDOWS\Explorer.EXE[744] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002D0A08
.text C:\WINDOWS\Explorer.EXE[744] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002D0600
.text C:\WINDOWS\Explorer.EXE[744] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002D01F8
.text C:\WINDOWS\Explorer.EXE[744] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002D03FC
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 000801F8
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000803FC
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002C0804
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002C0A08
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002C0600
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002C01F8
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002C03FC
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002D1014
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002D0804
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002D0A08
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002D0C0C
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002D0E10
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002D01F8
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002D03FC
.text C:\WINDOWS\ehome\mcrdsvc.exe[972] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002D0600
.text C:\WINDOWS\ehome\ehtray.exe[984] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 000A01F8
.text C:\WINDOWS\ehome\ehtray.exe[984] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\ehome\ehtray.exe[984] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 000A03FC
.text C:\WINDOWS\ehome\ehtray.exe[984] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\WINDOWS\ehome\ehtray.exe[984] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 002E0804
.text C:\WINDOWS\ehome\ehtray.exe[984] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 002E0A08
.text C:\WINDOWS\ehome\ehtray.exe[984] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 002E0600
.text C:\WINDOWS\ehome\ehtray.exe[984] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 002E01F8
.text C:\WINDOWS\ehome\ehtray.exe[984] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 002E03FC
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 002F1014
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 002F0804
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 002F0A08
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 002F0C0C
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 002F0E10
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 002F01F8
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 002F03FC
.text C:\WINDOWS\ehome\ehtray.exe[984] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 002F0600
.text C:\WINDOWS\System32\smss.exe[1008] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\system32\SysMonitor.exe[1044] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\system32\SysMonitor.exe[1044] KERNEL32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003A0804
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003A0A08
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003A0600
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003A01F8
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003A03FC
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003B1014
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003B0804
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003B0A08
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003B0C0C
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003B0E10
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003B01F8
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003B03FC
.text C:\Acer\Empowering Technology\eRecovery\eRAgent.exe[1068] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003B0600
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001501F8
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001503FC
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 00641014
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!ChangeServiceConfigA 77E06E69 5 Bytes JMP 00640804
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!ChangeServiceConfigW 77E07001 5 Bytes JMP 00640A08
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!ChangeServiceConfig2A 77E07101 5 Bytes JMP 00640C0C
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00640E10
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!CreateServiceA 77E07211 5 Bytes JMP 006401F8
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!CreateServiceW 77E073A9 5 Bytes JMP 006403FC
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] ADVAPI32.DLL!DeleteService 77E074B1 5 Bytes JMP 00640600
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 00650804
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00650A08
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 00650600
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 006501F8
.text C:\Acer\Empowering Technology\eDataSecurity\eDSloader.exe[1088] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 006503FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 00390804
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 00390A08
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 00390600
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003901F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003903FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003A1014
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003A0804
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003A0A08
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003A0C0C
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003A0E10
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003A01F8
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003A03FC
.text C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe[1100] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003A0600
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003A1014
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003A0804
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003A0A08
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003A0C0C
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003A0E10
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003A01F8
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003A03FC
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003A0600
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003B0804
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 3 Bytes JMP 003B0A08
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!UnhookWindowsHookEx + 4 7E3AD5F7 1 Byte [82]
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003B0600
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003B01F8
.text C:\Program Files\Fichiers communs\Java\Java Update\jusched.exe[1132] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003B03FC
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 3 Bytes JMP 00391014
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!SetServiceObjectSecurity + 4 77E06D85 1 Byte [88]
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 00390804
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 00390A08
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 00390C0C
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 00390E10
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003901F8
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003903FC
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 00390600
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003A0804
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003A0A08
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003A0600
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003A01F8
.text C:\Program Files\OO Software\Defrag\oodtray.exe[1144] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003A03FC
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003A1014
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003A0804
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003A0A08
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003A0C0C
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003A0E10
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003A01F8
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003A03FC
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003A0600
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003B0804
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 3 Bytes JMP 003B0A08
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!UnhookWindowsHookEx + 4 7E3AD5F7 1 Byte [82]
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003B0600
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003B01F8
.text C:\Program Files\DivX\DivX Update\DivXUpdate.exe[1152] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003B03FC
.text C:\WINDOWS\system32\csrss.exe[1172] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\WINDOWS\system32\csrss.exe[1172] KERNEL32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001601F8
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ntdll.dll!RtlDosSearchPath_U + 186 7C926865 1 Byte [62]
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ntdll.dll!LdrUnloadDll 7C9271CD 5 Bytes JMP 001603FC
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] kernel32.dll!GetBinaryTypeW + 80 7C868D8C 1 Byte [62]
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] USER32.dll!SetWindowsHookExW 7E3A820F 5 Bytes JMP 003A0804
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] USER32.dll!UnhookWindowsHookEx 7E3AD5F3 5 Bytes JMP 003A0A08
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] USER32.dll!SetWindowsHookExA 7E3B1211 5 Bytes JMP 003A0600
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] USER32.dll!SetWinEventHook 7E3B17F7 5 Bytes JMP 003A01F8
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] USER32.dll!UnhookWinEvent 7E3B18AC 5 Bytes JMP 003A03FC
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!SetServiceObjectSecurity 77E06D81 5 Bytes JMP 003B1014
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!ChangeServiceConfigA 77E06E69 5 Bytes JMP 003B0804
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!ChangeServiceConfigW 77E07001 5 Bytes JMP 003B0A08
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!ChangeServiceConfig2A 77E07101 5 Bytes JMP 003B0C0C
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!ChangeServiceConfig2W 77E07189 5 Bytes JMP 003B0E10
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!CreateServiceA 77E07211 5 Bytes JMP 003B01F8
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!CreateServiceW 77E073A9 5 Bytes JMP 003B03FC
.text C:\Program Files\SFR\Media Center\MediaCenter.exe[1180] ADVAPI32.dll!DeleteService 77E074B1 5 Bytes JMP 003B0600
.text C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe[1188] ntdll.dll!LdrLoadDll 7C92632D 5 Bytes JMP 001501F8
.text C:\Program Files\Fichiers communs\Ahead\Lib\NMBgMonitor.exe[1188] ntdll.

▶ Télécharge : Gmer (by Przemyslaw Gmerek) et enregistre-le sur ton bureau

Desactive toutes tes protections le temps du scan de gMer

Pour XP => double clique sur gmer.exe
Pour Vista et 7 => clique droit "executer en tant que...."

▶ clique sur l'onglet rootkit,lances le scan,des lignes rouges vont apparaitre.

▶ Les lignes rouges indiquent la presence d'un rootkit.Postes moi le rapport gmer (cliques sur copy,puis vas dans demarrer ,puis ouvres le bloc note,vas dans edition et cliques sur coller,le rapport gmer va apparaitre,postes moi le)

meme en restan appuyé sur la flech du haut il me demande pa de choix a faire?? cest pa normal ???