GMER 1.0.15.14972 - http://www.gmer.net Rootkit scan 2009-06-26 10:13:24 Windows 6.0.6001 Service Pack 1 ---- System - GMER 1.0.15 ---- SSDT 87108D90 ZwAlertResumeThread SSDT 87108E50 ZwAlertThread SSDT 87321678 ZwAllocateVirtualMemory SSDT 86F5C1D0 ZwAlpcConnectPort SSDT 87108578 ZwAssignProcessToJobObject SSDT 87108B20 ZwCreateMutant SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x881A3282] SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x881A3474] SSDT 874B3DB0 ZwCreateSymbolicLinkObject SSDT 87320B00 ZwCreateThread SSDT 87108658 ZwDebugActiveProcess SSDT 873217D0 ZwDuplicateObject SSDT 873214D8 ZwFreeVirtualMemory SSDT 87108C10 ZwImpersonateAnonymousToken SSDT 87108CD0 ZwImpersonateThread SSDT 86F323C0 ZwLoadDriver SSDT 873213F8 ZwMapViewOfSection SSDT 87108A40 ZwOpenEvent SSDT 87321970 ZwOpenProcess SSDT 86B2B568 ZwOpenProcessToken SSDT 87108880 ZwOpenSection SSDT 873218A0 ZwOpenThread SSDT 874B3F80 ZwProtectVirtualMemory SSDT 86BEC208 ZwResumeThread SSDT 873211E0 ZwSetContextThread SSDT 873212A0 ZwSetInformationProcess SSDT 87108738 ZwSetSystemInformation SSDT 87108960 ZwSuspendProcess SSDT 87108F10 ZwSuspendThread SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x881A2F32] SSDT 87108FD0 ZwTerminateThread SSDT 86F2FF60 ZwUnmapViewOfSection SSDT 873215A8 ZwWriteVirtualMemory SSDT 874B3EA0 ZwCreateThreadEx SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x881A367C] ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!KeSetTimerEx + 350 81EBF914 8 Bytes [90, 8D, 10, 87, 50, 8E, 10, ...] .text ntkrnlpa.exe!KeSetTimerEx + 364 81EBF928 4 Bytes [78, 16, 32, 87] .text ntkrnlpa.exe!KeSetTimerEx + 370 81EBF934 4 Bytes [D0, C1, F5, 86] .text ntkrnlpa.exe!KeSetTimerEx + 3C4 81EBF988 4 Bytes [78, 85, 10, 87] .text ntkrnlpa.exe!KeSetTimerEx + 428 81EBF9EC 4 Bytes [20, 8B, 10, 87] .text ... ? C:\Windows\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. ! ---- User code sections - GMER 1.0.15 ---- .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\svchost.exe[376] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[376] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[376] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\SMINST\BLService.exe[456] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\SMINST\BLService.exe[456] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\SMINST\BLService.exe[456] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\csrss.exe[500] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\csrss.exe[500] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\csrss.exe[500] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\wininit.exe[544] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\wininit.exe[544] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\wininit.exe[544] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\csrss.exe[552] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\csrss.exe[552] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\csrss.exe[552] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\winlogon.exe[600] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\winlogon.exe[600] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\winlogon.exe[600] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\services.exe[632] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\services.exe[632] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\lsass.exe[648] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\lsass.exe[648] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\lsm.exe[656] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\lsm.exe[656] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\lsm.exe[656] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\svchost.exe[744] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\svchost.exe[744] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\svchost.exe[744] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\svchost.exe[816] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[816] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[816] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\svchost.exe[880] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\svchost.exe[1048] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\svchost.exe[1048] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\svchost.exe[1048] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\svchost.exe[1088] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\svchost.exe[1088] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\svchost.exe[1088] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\svchost.exe[1100] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[1100] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[1100] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\svchost.exe[1248] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] kernel32.dll!CreateThread + 1A 75E246E2 4 Bytes CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools) .text C:\Windows\system32\svchost.exe[1372] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[1372] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[1372] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\WLANExt.exe[1496] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\WLANExt.exe[1496] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\WLANExt.exe[1496] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\spoolsv.exe[1568] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\spoolsv.exe[1568] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\spoolsv.exe[1568] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\svchost.exe[1620] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[1620] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[1620] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\taskeng.exe[1844] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\taskeng.exe[1844] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\taskeng.exe[1844] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\Dwm.exe[2176] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\Dwm.exe[2176] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\Dwm.exe[2176] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\Explorer.EXE[2216] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\Explorer.EXE[2216] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\Explorer.EXE[2216] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\taskeng.exe[2396] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Windows\system32\taskeng.exe[2396] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\System32\hkcmd.exe[2504] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\System32\igfxpers.exe[2632] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text C:\Windows\system32\svchost.exe[3172] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\svchost.exe[3172] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\svchost.exe[3172] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\System32\svchost.exe[3244] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\System32\svchost.exe[3244] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\System32\svchost.exe[3244] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] kernel32.dll!CreateThread + 1A 75E246E2 4 Bytes CALL 0044AB89 C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools) .text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\SearchIndexer.exe[3284] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\SearchIndexer.exe[3284] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\SearchIndexer.exe[3284] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\DRIVERS\xaudio.exe[3364] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\DRIVERS\xaudio.exe[3364] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\DRIVERS\xaudio.exe[3364] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\wbem\wmiprvse.exe[3500] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\wbem\wmiprvse.exe[3500] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\wbem\wmiprvse.exe[3500] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\igfxsrvc.exe[3528] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A .text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E] .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F] .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A .text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044AE68] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools) IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044AE68] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools) IAT C:\Program Files\Spyware Doctor\pctsTray.exe[3264] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044ACE0] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools) IAT C:\Program Files\Spyware Doctor\pctsTray.exe[3264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044ACE0] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation) AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS AttachedDevice \Driver\tdx \Device\RawIp SYMTDI.SYS ---- EOF - GMER 1.0.15 ----