Aller au contenu

  • Pas encore inscrit ?

    Pourquoi ne pas vous inscrire ? C'est simple, rapide et gratuit.
    Pour en savoir plus, lisez Les avantages de l'inscription... et la Charte de Zébulon.
    De plus, les messages que vous postez en tant qu'invité restent invisibles tant qu'un modérateur ne les a pas validés. Inscrivez-vous, ce sera un gain de temps pour tout le monde, vous, les helpeurs et les modérateurs ! :wink:

forte suspicion d'infection

rossi_kawa

Par rossi_kawa
dans Analyses et éradication malwares

 Partager

Messages recommandés

rossi_kawa Member

rossi_kawa

Posté(e)
  • Auteur
Posté(e)

Bonsoir Pear,

 

Comme demandé, voici (encopier-coller, car pas de fichier.log créé), le rapport de Kaspersky Virus Removal Tool 2010:

 

A bientôt.

 

 

 

Autoscan: completed 4 minutes ago (events: 9, objects: 340053, time: 01:23:23)

20/07/2010 19:46:21 Task started

20/07/2010 21:21:29 Detected: HEUR:Trojan.Win32.StartPage C:\Program Files\eChanblard\config\updater.exe

20/07/2010 21:51:19 Detected: HEUR:Trojan.Win32.StartPage C:\System Volume Information\_restore{3B0B07F2-42FE-4807-B606-4B97DC04CDF5}\RP442\A0614269.exe

20/07/2010 22:34:56 Detected: Rootkit.Win32.TDSS.d Unknown application

20/07/2010 22:34:56 Cannot be backed up: Rootkit.Win32.TDSS.d Unknown application

20/07/2010 22:38:30 Detected: Rootkit.Win32.TDSS.d System Memory

20/07/2010 22:47:09 Task stopped

20/07/2010 22:58:10 Task started

21/07/2010 00:21:33 Task completed

 

Disinfect active threats: completed 1 hour ago (events: 7, objects: 4434, time: 00:02:43)

20/07/2010 22:47:08 Task started

20/07/2010 22:47:09 Detected: Rootkit.Win32.TDSS.d System Memory

20/07/2010 22:47:19 Disinfected: Rootkit.Win32.TDSS.d System Memory

20/07/2010 22:47:19 Disinfected: Rootkit.Win32.TDSS.d System Memory

20/07/2010 22:48:15 Detected: Rootkit.Win32.TDSS.d Unknown application

20/07/2010 22:48:15 Cannot be backed up: Rootkit.Win32.TDSS.d Unknown application

20/07/2010 22:49:51 Task completed

pear Devil Member !

pear

Posté(e)
Posté(e)

Bonjour,

 

Téléchargez les logiciels suivants pour les lancer l'un après l'autre.

Vous en posterez les rapports ensuite, en fin de procédures

Télécharger load_tdsskiller de Loup Blanc sur le Bureau

Cet outil est conçu pour automatiser différentes tâches proposées par TDSSKiller, un fix de Kaspersky.

  • Lancer load_tdsskiller en double-cliquant dessus :
    l'outil va se connecter au Net pour télécharger une copie à jour de TDSSKiller et lancer le scan
  • Un message dans la fenêtre noire d'invite de commande vous demandera d'appuyer sur une touche pour continuer
  • Le rapport s'affichera automatiquement : copier-coller son contenu dans la prochaine réponse
    (le fichier est également présent ici : C:\tdsskiller\report.txt)
  • Redémarrer le PC

 

Télécharger Rkill de Grinler sur le bureau,

double clic pour le lancer.

Sous Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur"

Une fenêtre (très rapide) indiquera que tout s'est bien déroulé.

Pour Vista, faire un clic droit sur le fichier rkill téléchargé puis choisir "Exécuter en tant qu'Administrateur" pour lancer l'outil.

il y aura 'un rapport là: %SystemDrive%\rkill.log

donnant la liste de tous les processus arrêtés.

 

Désinstallez Mbam, s'il est installé

Téléchargez MBAM

Choisir "Enregistrer la cible du lien..sous....bitruc.com

Choisir le bureau

En bas, à Nom du Fichier:

Vous devez obtenir ->bitruc.com

Cliquez enfin sur -> Enregistrer

Lancez bitruc.com et sauvegardez le sur le bureau

 

Branchez tous les supports amovibles avant de faire ce scan (clé usb/disque dur externe etc)

Vous devez désactiver vos protections et ne savez pas comment faire ->Sur PCA,En Français

* Double cliquez sur l'icône Download_mbam-setup.exe pour lancer le processus d'installation.

Enregistrez le sur le bureau .

Fermer toutes les fenêtres et programmes

Suivez les indications (en particulier le choix de la langue et l'autorisation d'accession à Internet)

N'apportez aucune modification aux réglages par défaut et, en fin d'installation,

Vérifiez que les options Update et Launch soient cochées

MBAM démarrera automatiquement et enverra un message demandant à mettre à jour le programme avant de lancer une analyse.

cliquer sur OK pour fermer la boîte de dialogue..

* Dans l'onglet "mise à jour", cliquez sur le bouton Recherche de mise à jour:

mbam.jpg

Si le pare-feu demande l'autorisation à MBAM de se connecter, acceptez.

* Une fois la mise à jour terminée, allez dans l'onglet Recherche.

* Sélectionnez "Exécuter un examen complet"

* Cliquez sur "Rechercher"

* .L' analyse prendra un certain temps, soyez patient !

* A la fin , un message affichera :

L'examen s'est terminé normalement.

 

*Si MBAM n'a rien trouvé, il le dira aussi.

Cliquez sur "Ok" pour poursuivre.

*Fermez les navigateurs.

Cliquez sur Afficher les résultats .

 

*Sélectionnez tout et cliquez sur Supprimer la sélection ,

MBAM va détruire les fichiers et clés de registre et en mettre une copie dans la quarantaine.

puis ouvrir le Bloc-notes et y copier le rapport d'analyse qui peut être retrouvé sous l'onglet Rapports/logs.

* Copiez-collez ce rapport dans la prochaine réponse.

rossi_kawa Member

rossi_kawa

Posté(e)
  • Auteur
Posté(e)

Bonjou Pear,

 

Outils exécutés, mais une petite chose:

 

- erreur 404 pour la page lien MBAM, je suis allé en chercher un autre, sur clubic, en espérant que c'est bon.

 

Voici les rapports

 

 

19:53:35:156 0704 TDSS rootkit removing tool 2.3.2.2 Jun 30 2010 17:23:49

19:53:35:156 0704 ================================================================================

19:53:35:156 0704 SystemInfo:

 

19:53:35:156 0704 OS Version: 5.1.2600 ServicePack: 2.0

19:53:35:156 0704 Product type: Workstation

19:53:35:156 0704 ComputerName: MARTIAL

19:53:35:156 0704 UserName: MARTIAL

19:53:35:156 0704 Windows directory: C:\WINDOWS

19:53:35:156 0704 System windows directory: C:\WINDOWS

19:53:35:156 0704 Processor architecture: Intel x86

19:53:35:156 0704 Number of processors: 1

19:53:35:156 0704 Page size: 0x1000

19:53:35:156 0704 Boot type: Normal boot

19:53:35:156 0704 ================================================================================

19:53:35:609 0704 Initialize success

19:53:35:609 0704

19:53:35:609 0704 Scanning Services ...

19:53:36:187 0704 Raw services enum returned 409 services

19:53:36:203 0704

19:53:36:203 0704 Scanning Drivers ...

19:53:37:281 0704 ACPI (0bd94fbfc14ea3606cd6ca4c0255baa3) C:\WINDOWS\system32\DRIVERS\ACPI.sys

19:53:37:312 0704 ACPIEC (e4abc1212b70bb03d35e60681c447210) C:\WINDOWS\system32\DRIVERS\ACPIEC.sys

19:53:37:375 0704 aec (1ee7b434ba961ef845de136224c30fec) C:\WINDOWS\system32\drivers\aec.sys

19:53:37:421 0704 AegisP (f64a0e456d08e6cda801fe13a5996e86) C:\WINDOWS\system32\DRIVERS\AegisP.sys

19:53:37:453 0704 AFD (55e6e1c51b6d30e54335750955453702) C:\WINDOWS\System32\drivers\afd.sys

19:53:37:515 0704 AFS2K (b34b1ab0a7690a0e2301fec6d17b2fc1) C:\WINDOWS\system32\drivers\AFS2K.sys

19:53:37:625 0704 AgereSoftModem (052343cd49c8da20c48958cfe73c7d44) C:\WINDOWS\system32\DRIVERS\AGRSM.sys

19:53:37:687 0704 agp440 (2c428fa0c3e3a01ed93c9b2a27d8d4bb) C:\WINDOWS\system32\DRIVERS\agp440.sys

19:53:37:750 0704 ALCXSENS (ba88534a3ceb6161e7432438b9ea4f54) C:\WINDOWS\system32\drivers\ALCXSENS.SYS

19:53:38:046 0704 ALCXWDM (dd8520280304b6145a6be31008748c7c) C:\WINDOWS\system32\drivers\ALCXWDM.SYS

19:53:38:250 0704 ApfiltrService (3ed81e8b4709d13e5a38db2d8e792b28) C:\WINDOWS\system32\DRIVERS\Apfiltr.sys

19:53:38:296 0704 Arp1394 (f0d692b0bffb46e30eb3cea168bbc49f) C:\WINDOWS\system32\DRIVERS\arp1394.sys

19:53:38:359 0704 Aspi32 (ed8cee58c1e4c5893f5b2fd686a272bf) C:\WINDOWS\system32\drivers\Aspi32.sys

19:53:38:375 0704 AsyncMac (02000abf34af4c218c35d257024807d6) C:\WINDOWS\system32\DRIVERS\asyncmac.sys

19:53:38:406 0704 atapi (cdfe4411a69c224bd1d11b2da92dac51) C:\WINDOWS\system32\DRIVERS\atapi.sys

19:53:38:515 0704 ati2mtag (5e3603e9fba29e01f5ffc108276b3005) C:\WINDOWS\system32\DRIVERS\ati2mtag.sys

19:53:38:546 0704 Atmarpc (ec88da854ab7d7752ec8be11a741bb7f) C:\WINDOWS\system32\DRIVERS\atmarpc.sys

19:53:38:578 0704 audstub (d9f724aa26c010a217c97606b160ed68) C:\WINDOWS\system32\DRIVERS\audstub.sys

19:53:38:656 0704 avgio (f1d43170fdd7399ee17ea32d4f868b0c) C:\Program Files\Avira\AntiVir Desktop\avgio.sys

19:53:38:687 0704 avgntflt (14fe36d8f2c6a2435275338d061a0b66) C:\WINDOWS\system32\DRIVERS\avgntflt.sys

19:53:38:718 0704 avipbb (ad9bd66a862116e79cb45bb6be46055f) C:\WINDOWS\system32\DRIVERS\avipbb.sys

19:53:38:781 0704 Beep (da1f27d85e0d1525f6621372e7b685e9) C:\WINDOWS\system32\drivers\Beep.sys

19:53:38:968 0704 cbidf2k (90a673fc8e12a79afbed2576f6a7aaf9) C:\WINDOWS\system32\drivers\cbidf2k.sys

19:53:39:000 0704 CCDECODE (6163ed60b684bab19d3352ab22fc48b2) C:\WINDOWS\system32\DRIVERS\CCDECODE.sys

19:53:39:031 0704 Cdaudio (c1b486a7658353d33a10cc15211a873b) C:\WINDOWS\system32\drivers\Cdaudio.sys

19:53:39:078 0704 Cdfs (cd7d5152df32b47f4e36f710b35aae02) C:\WINDOWS\system32\drivers\Cdfs.sys

19:53:39:093 0704 Cdrom (af9c19b3100fe010496b1a27181fbf72) C:\WINDOWS\system32\DRIVERS\cdrom.sys

19:53:39:140 0704 CmBatt (4266be808f85826aedf3c64c1e240203) C:\WINDOWS\system32\DRIVERS\CmBatt.sys

19:53:39:171 0704 CnxEtP (3bd0cc3b08ef8dc922ddc79ddd3c60e3) C:\WINDOWS\system32\DRIVERS\CnxEtP.sys

19:53:39:234 0704 CnxEtU (71bbbff3eecb454098dc5a4697d86fb1) C:\WINDOWS\system32\DRIVERS\CnxEtU.sys

19:53:39:281 0704 CnxTgN (4717c94d1bd769a92687172c7672abec) C:\WINDOWS\system32\DRIVERS\CnxTgN.sys

19:53:39:296 0704 Compbatt (df1b1a24bf52d0ebc01ed4ece8979f50) C:\WINDOWS\system32\DRIVERS\compbatt.sys

19:53:39:375 0704 CrystalSysInfo (f054744f67576a01139885173392502b) C:\Program Files\MediaCoder\SysInfo.sys

19:53:39:421 0704 Disk (00ca44e4534865f8a3b64f7c0984bff0) C:\WINDOWS\system32\DRIVERS\disk.sys

19:53:39:453 0704 DKbFltr (e73b3a5337ea55c2bae2a1a0caf7a728) C:\WINDOWS\system32\Drivers\DKbFltr.sys

19:53:39:515 0704 dmboot (e2d3b7620310fe56685f9b15a6b404b3) C:\WINDOWS\system32\drivers\dmboot.sys

19:53:39:609 0704 dmio (c77f5c20aa70197a69aa84baa9de43c8) C:\WINDOWS\system32\drivers\dmio.sys

19:53:39:656 0704 dmload (e9317282a63ca4d188c0df5e09c6ac5f) C:\WINDOWS\system32\drivers\dmload.sys

19:53:39:671 0704 DMusic (a6f881284ac1150e37d9ae47ff601267) C:\WINDOWS\system32\drivers\DMusic.sys

19:53:39:781 0704 driverhardwarev2 (c41475b94aa665fcf3ddaf9a0852e194) C:\Program Files\ma-config.com\Drivers\driverhardwarev2.sys

19:53:39:796 0704 drmkaud (1ed4dbbae9f5d558dbba4cc450e3eb2e) C:\WINDOWS\system32\drivers\drmkaud.sys

19:53:39:859 0704 drvmcdb (ae4f1425f8da291136c788fb17d34f4d) C:\WINDOWS\system32\drivers\drvmcdb.sys

19:53:39:875 0704 drvnddm (b295700e684ed1984db1d6be40354421) C:\WINDOWS\system32\drivers\drvnddm.sys

19:53:39:906 0704 EMSCR (6428a1ce5abe3e71a97dfdda0a19546f) C:\WINDOWS\system32\DRIVERS\EMS7SK.sys

19:53:39:921 0704 EPOWER (0b07768ae046f9ed6a75e5bc75660828) C:\WINDOWS\system32\Drivers\hkdrv.sys

19:53:39:937 0704 ESDCR (772127b385dec14b13325d9efcc0ac14) C:\WINDOWS\system32\DRIVERS\ESD7SK.sys

19:53:39:968 0704 ESMCR (472ea4e9734147f8ada93c4ab944b958) C:\WINDOWS\system32\DRIVERS\ESM7SK.sys

19:53:40:031 0704 Fastfat (3117f595e9615e04f05a54fc15a03b20) C:\WINDOWS\system32\drivers\Fastfat.sys

19:53:40:062 0704 Fdc (ced2e8396a8838e59d8fd529c680e02c) C:\WINDOWS\system32\drivers\Fdc.sys

19:53:40:109 0704 Fips (8b121ff880683607ab2aef0340721718) C:\WINDOWS\system32\drivers\Fips.sys

19:53:40:140 0704 Flpydisk (0dd1de43115b93f4d85e889d7a86f548) C:\WINDOWS\system32\drivers\Flpydisk.sys

19:53:40:171 0704 FltMgr (3d234fb6d6ee875eb009864a299bea29) C:\WINDOWS\system32\drivers\fltmgr.sys

19:53:40:203 0704 fssfltr (c6ee3a87fe609d3e1db9dbd072a248de) C:\WINDOWS\system32\DRIVERS\fssfltr_tdi.sys

19:53:40:312 0704 Fs_Rec (3e1e2bd4f39b0e2b7dc4f4d2bcc2779a) C:\WINDOWS\system32\drivers\Fs_Rec.sys

19:53:40:328 0704 Ftdisk (a86859b77b908c18c2657f284aa29fe3) C:\WINDOWS\system32\DRIVERS\ftdisk.sys

19:53:40:390 0704 fwdrv (1ff2eef447a177df2c544b80f8f7f879) C:\WINDOWS\system32\drivers\fwdrv.sys

19:53:40:578 0704 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\WINDOWS\system32\Drivers\GEARAspiWDM.sys

19:53:40:718 0704 giveio (77ebf3e9386daa51551af429052d88d0) C:\WINDOWS\system32\giveio.sys

19:53:40:750 0704 Gpc (c0f1d4a21de5a415df8170616703debf) C:\WINDOWS\system32\DRIVERS\msgpc.sys

19:53:40:765 0704 grmnusb (d956358054e99e6ffac69cd87e893a89) C:\WINDOWS\system32\drivers\grmnusb.sys

19:53:40:781 0704 HidUsb (1de6783b918f540149aa69943bdfeba8) C:\WINDOWS\system32\DRIVERS\hidusb.sys

19:53:40:859 0704 HPZid412 (d03d10f7ded688fecf50f8fbf1ea9b8a) C:\WINDOWS\system32\DRIVERS\HPZid412.sys

19:53:40:906 0704 HPZipr12 (89f41658929393487b6b7d13c8528ce3) C:\WINDOWS\system32\DRIVERS\HPZipr12.sys

19:53:40:921 0704 HPZius12 (abcb05ccdbf03000354b9553820e39f8) C:\WINDOWS\system32\DRIVERS\HPZius12.sys

19:53:40:968 0704 HTTP (9f8b0f4276f618964fd118be4289b7cd) C:\WINDOWS\system32\Drivers\HTTP.sys

19:53:41:015 0704 i8042prt (d1efcbd693b5ba21314d06368c471070) C:\WINDOWS\system32\DRIVERS\i8042prt.sys

19:53:41:031 0704 Imapi (f8aa320c6a0409c0380e5d8a99d76ec6) C:\WINDOWS\system32\DRIVERS\imapi.sys

19:53:41:078 0704 IntelIde (1367812f8a974e0c13a4888fa5e7ede6) C:\WINDOWS\system32\DRIVERS\intelide.sys

19:53:41:156 0704 intelppm (dd5ad1e79ac26d3f8d8828ad4627f160) C:\WINDOWS\system32\DRIVERS\intelppm.sys

19:53:41:171 0704 Ip6Fw (4448006b6bc60e6c027932cfc38d6855) C:\WINDOWS\system32\drivers\ip6fw.sys

19:53:41:187 0704 IpFilterDriver (731f22ba402ee4b62748adaf6363c182) C:\WINDOWS\system32\DRIVERS\ipfltdrv.sys

19:53:41:218 0704 IpInIp (e1ec7f5da720b640cd8fb8424f1b14bb) C:\WINDOWS\system32\DRIVERS\ipinip.sys

19:53:41:250 0704 IpNat (e2168cbc7098ffe963c6f23f472a3593) C:\WINDOWS\system32\DRIVERS\ipnat.sys

19:53:41:265 0704 IPSec (64537aa5c003a6afeee1df819062d0d1) C:\WINDOWS\system32\DRIVERS\ipsec.sys

19:53:41:281 0704 irda (86c204836feec22510d434982d4221b8) C:\WINDOWS\system32\DRIVERS\irda.sys

19:53:41:296 0704 IRENUM (50708daa1b1cbb7d6ac1cf8f56a24410) C:\WINDOWS\system32\DRIVERS\irenum.sys

19:53:41:328 0704 isapnp (54632f1a7de61dc3615d756f2a90fa72) C:\WINDOWS\system32\DRIVERS\isapnp.sys

19:53:41:343 0704 Kbdclass (e798705e8dc7fab596ef6bfdf167e007) C:\WINDOWS\system32\DRIVERS\kbdclass.sys

19:53:41:390 0704 khips (304ce9fb3d64caa07b940bef4f8c2dcd) C:\WINDOWS\system32\drivers\khips.sys

19:53:41:406 0704 klmd23 (316353165feba3d0538eaa9c2f60c5b7) C:\WINDOWS\system32\drivers\klmd.sys

19:53:41:437 0704 kmixer (ba5deda4d934e6288c2f66caf58d2562) C:\WINDOWS\system32\drivers\kmixer.sys

19:53:41:484 0704 KSecDD (674d3e5a593475915dc6643317192403) C:\WINDOWS\system32\drivers\KSecDD.sys

19:53:41:500 0704 meiudf (6a75fd0b5f008d711dc44d9693e8d632) C:\WINDOWS\system32\Drivers\meiudf.sys

19:53:41:562 0704 mnmdd (4ae068242760a1fb6e1a44bf4e16afa6) C:\WINDOWS\system32\drivers\mnmdd.sys

19:53:41:593 0704 Modem (5ac7e16f5b40a6da14b5f2b3ada4693e) C:\WINDOWS\system32\drivers\Modem.sys

19:53:41:640 0704 Mouclass (7d4f19411bd941e1d432a99e24230386) C:\WINDOWS\system32\drivers\mouclass.kav

19:53:41:671 0704 mouhid (124d6846040c79b9c997f78ef4b2a4e5) C:\WINDOWS\system32\DRIVERS\mouhid.sys

19:53:41:687 0704 MountMgr (65653f3b4477f3c63e68a9659f85ee2e) C:\WINDOWS\system32\drivers\MountMgr.sys

19:53:41:734 0704 MRxDAV (29414447eb5bde2f8397dc965dbb3156) C:\WINDOWS\system32\DRIVERS\mrxdav.sys

19:53:41:796 0704 MRxSmb (fb6c89bb3ce282b08bdb1e3c179e1c39) C:\WINDOWS\system32\DRIVERS\mrxsmb.sys

19:53:41:906 0704 Msfs (561b3a4333ca2dbdba28b5b956822519) C:\WINDOWS\system32\drivers\Msfs.sys

19:53:41:937 0704 MSIRCOMM (ee55f5c64417cc369866d7eafe9b07ab) C:\WINDOWS\system32\DRIVERS\MSIRCOMM.sys

19:53:41:968 0704 MSKSSRV (ae431a8dd3c1d0d0610cdbac16057ad0) C:\WINDOWS\system32\drivers\MSKSSRV.sys

19:53:41:984 0704 MSPCLOCK (13e75fef9dfeb08eeded9d0246e1f448) C:\WINDOWS\system32\drivers\MSPCLOCK.sys

19:53:42:031 0704 MSPQM (1988a33ff19242576c3d0ef9ce785da7) C:\WINDOWS\system32\drivers\MSPQM.sys

19:53:42:062 0704 mssmbios (469541f8bfd2b32659d5d463a6714bce) C:\WINDOWS\system32\DRIVERS\mssmbios.sys

19:53:42:093 0704 MSTEE (bf13612142995096ab084f2db7f40f77) C:\WINDOWS\system32\drivers\MSTEE.sys

19:53:42:109 0704 Mup (82035e0f41c2dd05ae41d27fe6cf7de1) C:\WINDOWS\system32\drivers\Mup.sys

19:53:42:140 0704 NABTSFEC (5c8dc6429c43dc6177c1fa5b76290d1a) C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys

19:53:42:171 0704 NDIS (558635d3af1c7546d26067d5d9b6959e) C:\WINDOWS\system32\drivers\NDIS.sys

19:53:42:187 0704 NdisIP (520ce427a8b298f54112857bcf6bde15) C:\WINDOWS\system32\DRIVERS\NdisIP.sys

19:53:42:218 0704 NdisTapi (08d43bbdacdf23f34d79e44ed35c1b4c) C:\WINDOWS\system32\DRIVERS\ndistapi.sys

19:53:42:265 0704 Ndisuio (34d6cd56409da9a7ed573e1c90a308bf) C:\WINDOWS\system32\DRIVERS\ndisuio.sys

19:53:42:281 0704 NdisWan (0b90e255a9490166ab368cd55a529893) C:\WINDOWS\system32\DRIVERS\ndiswan.sys

19:53:42:296 0704 NDProxy (59fc3fb44d2669bc144fd87826bb571f) C:\WINDOWS\system32\drivers\NDProxy.sys

19:53:42:312 0704 NetBIOS (3a2aca8fc1d7786902ca434998d7ceb4) C:\WINDOWS\system32\DRIVERS\netbios.sys

19:53:42:328 0704 NetBT (0c80e410cd2f47134407ee7dd19cc86b) C:\WINDOWS\system32\DRIVERS\netbt.sys

19:53:42:375 0704 Netdevio (1265eb253ed4ebe4acb3bd5f548ff796) C:\WINDOWS\system32\DRIVERS\netdevio.sys

19:53:42:406 0704 NIC1394 (5c5c53db4fef16cf87b9911c7e8c6fbc) C:\WINDOWS\system32\DRIVERS\nic1394.sys

19:53:42:421 0704 Npfs (4f601bcb8f64ea3ac0994f98fed03f8e) C:\WINDOWS\system32\drivers\Npfs.sys

19:53:42:468 0704 Ntfs (19a811ef5f1ed5c926a028ce107ff1af) C:\WINDOWS\system32\drivers\Ntfs.sys

19:53:42:562 0704 Null (73c1e1f395918bc2c6dd67af7591a3ad) C:\WINDOWS\system32\drivers\Null.sys

19:53:42:593 0704 NwlnkFlt (b305f3fad35083837ef46a0bbce2fc57) C:\WINDOWS\system32\DRIVERS\nwlnkflt.sys

19:53:42:625 0704 NwlnkFwd (c99b3415198d1aab7227f2c88fd664b9) C:\WINDOWS\system32\DRIVERS\nwlnkfwd.sys

19:53:42:656 0704 ohci1394 (0951db8e5823ea366b0e408d71e1ba2a) C:\WINDOWS\system32\DRIVERS\ohci1394.sys

19:53:42:718 0704 ovt530 (71cffb1e06aa8978a7b4a346c191f8ba) C:\WINDOWS\system32\Drivers\ov530vid.sys

19:53:42:765 0704 Parport (318696359ac7df48d1e51974ec527dd2) C:\WINDOWS\system32\DRIVERS\parport.sys

19:53:42:781 0704 PartMgr (3334430c29dc338092f79c38ef7b4cd0) C:\WINDOWS\system32\drivers\PartMgr.sys

19:53:42:859 0704 ParVdm (9575c5630db8fb804649a6959737154c) C:\WINDOWS\system32\drivers\ParVdm.sys

19:53:42:890 0704 pavboot (3adb8bd6154a3ef87496e8fce9c22493) C:\WINDOWS\system32\drivers\pavboot.sys

19:53:42:937 0704 PCAMPR5 (b670c5d89f0726b7a2a7dfb4e968cdf8) C:\WINDOWS\system32\PCAMPR5.SYS

19:53:43:000 0704 PCANDIS5 (ecd2f9d67b06606064daf6961a6d5efe) C:\WINDOWS\system32\PCANDIS5.SYS

19:53:43:015 0704 PCI (7c5da5c1ed801ad8b0309d5514f0b75e) C:\WINDOWS\system32\DRIVERS\pci.sys

19:53:43:046 0704 PCIIde (f4bfde7209c14a07aaa61e4d6ae69eac) C:\WINDOWS\system32\DRIVERS\pciide.sys

19:53:43:140 0704 Pcmcia (641da274e163617ea7a33506bc6da8e3) C:\WINDOWS\system32\DRIVERS\pcmcia.sys

19:53:43:203 0704 pcouffin (5b6c11de7e839c05248ced8825470fef) C:\WINDOWS\system32\Drivers\pcouffin.sys

19:53:43:296 0704 Pfc (444f122e68db44c0589227781f3c8b3f) C:\WINDOWS\system32\drivers\pfc.sys

19:53:43:359 0704 PptpMiniport (1c5cc65aac0783c344f16353e60b72ac) C:\WINDOWS\system32\DRIVERS\raspptp.sys

19:53:43:390 0704 Ptilink (80d317bd1c3dbc5d4fe7b1678c60cadd) C:\WINDOWS\system32\DRIVERS\ptilink.sys

19:53:43:421 0704 PxHelp20 (81088114178112618b1c414a65e50f7c) C:\WINDOWS\system32\Drivers\PxHelp20.sys

19:53:43:515 0704 RasAcd (fe0d99d6f31e4fad8159f690d68ded9c) C:\WINDOWS\system32\DRIVERS\rasacd.sys

19:53:43:562 0704 Rasirda (0207d26ddf796a193ccd9f83047bb5fc) C:\WINDOWS\system32\DRIVERS\rasirda.sys

19:53:43:578 0704 Rasl2tp (98faeb4a4dcf812ba1c6fca4aa3e115c) C:\WINDOWS\system32\DRIVERS\rasl2tp.sys

19:53:43:593 0704 RasPppoe (7306eeed8895454cbed4669be9f79faa) C:\WINDOWS\system32\DRIVERS\raspppoe.sys

19:53:43:609 0704 Raspti (fdbb1d60066fcfbb7452fd8f9829b242) C:\WINDOWS\system32\DRIVERS\raspti.sys

19:53:43:640 0704 Rdbss (03b965b1ca47f6ef60eb5e51cb50e0af) C:\WINDOWS\system32\DRIVERS\rdbss.sys

19:53:43:671 0704 RDPCDD (4912d5b403614ce99c28420f75353332) C:\WINDOWS\system32\DRIVERS\RDPCDD.sys

19:53:43:703 0704 RDPWD (b54cd38a9ebfbf2b3561426e3fe26f62) C:\WINDOWS\system32\drivers\RDPWD.sys

19:53:43:734 0704 redbook (2cc30b68dd62b73d444a41322cd7fc4c) C:\WINDOWS\system32\DRIVERS\redbook.sys

19:53:43:906 0704 RTL8023 (29f9879a1fd386f7251ae9fdadb2cbf1) C:\WINDOWS\system32\DRIVERS\Rtlnic51.sys

19:53:43:937 0704 rtl8139 (d507c1400284176573224903819ffda3) C:\WINDOWS\system32\DRIVERS\RTL8139.SYS

19:53:43:984 0704 s24trans (49b4b6a0f04ef8578e9a3f2915a84ac9) C:\WINDOWS\system32\DRIVERS\s24trans.sys

19:53:44:046 0704 sdbus (02fc71b020ec8700ee8a46c58bc6f276) C:\WINDOWS\system32\DRIVERS\sdbus.sys

19:53:44:109 0704 Secdrv (90a3935d05b494a5a39d37e71f09a677) C:\WINDOWS\system32\DRIVERS\secdrv.sys

19:53:44:156 0704 Serial (653201755ca96ab4aaa4131daf6da356) C:\WINDOWS\system32\drivers\Serial.sys

19:53:44:187 0704 Sfloppy (0d13b6df6e9e101013a7afb0ce629fe0) C:\WINDOWS\system32\drivers\Sfloppy.sys

19:53:44:281 0704 SLIP (5caeed86821fa2c6139e32e9e05ccdc9) C:\WINDOWS\system32\DRIVERS\SLIP.sys

19:53:44:328 0704 SMCIRDA (a8eb0aa07632a4c936ff6f8eda5bdead) C:\WINDOWS\system32\DRIVERS\smcirda.sys

19:53:44:421 0704 SONYPVU1 (a1eceeaa5c5e74b2499eb51d38185b84) C:\WINDOWS\system32\DRIVERS\SONYPVU1.SYS

19:53:44:468 0704 speedfan (5d6401db90ec81b71f8e2c5c8f0fef23) C:\WINDOWS\system32\speedfan.sys

19:53:44:578 0704 splitter (0ce218578fff5f4f7e4201539c45c78f) C:\WINDOWS\system32\drivers\splitter.sys

19:53:44:593 0704 sr (b52181023b827acda36c1b76751ebffd) C:\WINDOWS\system32\DRIVERS\sr.sys

19:53:44:640 0704 Srv (7a4f147cc6b133f905f6e65e2f8669fb) C:\WINDOWS\system32\DRIVERS\srv.sys

19:53:44:703 0704 SrvcEKIOMngr (3b01a9316255cdd17f9c8e79aa573406) C:\WINDOWS\system32\Drivers\EKIoMngr.sys

19:53:44:734 0704 SrvcEPECioctl (b8b410a6cc3e65799135b8e92288d37d) C:\WINDOWS\system32\Drivers\ECioctl.sys

19:53:44:734 0704 SrvcEPIOMngr (c996c839a3261cab5409c61e5702b620) C:\WINDOWS\system32\Drivers\EPIoMngr.sys

19:53:44:750 0704 SrvcSSIOMngr (79b7af340d55861df1d69e7bac975fcc) C:\WINDOWS\system32\Drivers\SSIoMngr.sys

19:53:44:765 0704 SrvcTPIOMngr (cbc0be9758bace83fc9ac25f4cca20e7) C:\WINDOWS\system32\Drivers\TPIoMngr.sys

19:53:44:796 0704 sscdbhk5 (d7968049be0adbb6a57cee3960320911) C:\WINDOWS\system32\drivers\sscdbhk5.sys

19:53:44:828 0704 ssmdrv (3ad0362cf68de3ac500e981700242cca) C:\WINDOWS\system32\DRIVERS\ssmdrv.sys

19:53:44:843 0704 ssrtln (c3ffd65abfb6441e7606cf74f1155273) C:\WINDOWS\system32\drivers\ssrtln.sys

19:53:44:890 0704 streamip (284c57df5dc7abca656bc2b96a667afb) C:\WINDOWS\system32\DRIVERS\StreamIP.sys

19:53:44:921 0704 swenum (03c1bae4766e2450219d20b993d6e046) C:\WINDOWS\system32\DRIVERS\swenum.sys

19:53:44:953 0704 swmidi (94abc808fc4b6d7d2bbf42b85e25bb4d) C:\WINDOWS\system32\drivers\swmidi.sys

19:53:45:031 0704 sysaudio (650ad082d46bac0e64c9c0e0928492fd) C:\WINDOWS\system32\drivers\sysaudio.sys

19:53:45:078 0704 Tcpip (1cc09561e21a48a7f649a40f18235860) C:\WINDOWS\system32\DRIVERS\tcpip.sys

19:53:45:125 0704 Tcpip6 (be4007ab8c9b62e3688fc2f469b98190) C:\WINDOWS\system32\DRIVERS\tcpip6.sys

19:53:45:187 0704 TDPIPE (38d437cf2d98965f239b0abcd66dcb0f) C:\WINDOWS\system32\drivers\TDPIPE.sys

19:53:45:234 0704 TDTCP (ed0580af02502d00ad8c4c066b156be9) C:\WINDOWS\system32\drivers\TDTCP.sys

19:53:45:250 0704 TermDD (a540a99c281d933f3d69d55e48727f47) C:\WINDOWS\system32\DRIVERS\termdd.sys

19:53:45:296 0704 tfsnboio (12534d6993893ece8ccb6e141eca167b) C:\WINDOWS\system32\dla\tfsnboio.sys

19:53:45:343 0704 tfsncofs (2b9b9da9b1d6d29aadd6e25a22c4d07f) C:\WINDOWS\system32\dla\tfsncofs.sys

19:53:45:359 0704 tfsndrct (284b4f17ad218b1709831252734e0092) C:\WINDOWS\system32\dla\tfsndrct.sys

19:53:45:390 0704 tfsndres (9ece1730d57bb1b027d37daab3762d9d) C:\WINDOWS\system32\dla\tfsndres.sys

19:53:45:406 0704 tfsnifs (8965155985656f130909d9be37d6e8c2) C:\WINDOWS\system32\dla\tfsnifs.sys

19:53:45:421 0704 tfsnopio (7187844d442b3b983bab0f98087aa276) C:\WINDOWS\system32\dla\tfsnopio.sys

19:53:45:437 0704 tfsnpool (7a82f090a98d692573334f956a9826cc) C:\WINDOWS\system32\dla\tfsnpool.sys

19:53:45:437 0704 tfsnudf (9ba9cbc21414475e488af0dab74ed9bd) C:\WINDOWS\system32\dla\tfsnudf.sys

19:53:45:468 0704 tfsnudfa (21246b5aa05afe2861a0e30c018c79f6) C:\WINDOWS\system32\dla\tfsnudfa.sys

19:53:45:515 0704 tunmp (87a0e9e18c10a9e454238e3330e2a26d) C:\WINDOWS\system32\DRIVERS\tunmp.sys

19:53:45:562 0704 TVICHW32 (e266683fc95abdec17cd378564e1b54b) C:\WINDOWS\system32\DRIVERS\TVICHW32.SYS

19:53:45:609 0704 Udfs (12f70256f140cd7d52c58c7048fde657) C:\WINDOWS\system32\drivers\Udfs.sys

19:53:45:687 0704 Update (ced744117e91bdc0beb810f7d8608183) C:\WINDOWS\system32\DRIVERS\update.sys

19:53:45:765 0704 USBAAPL (4b8a9c16b6d9258ed99c512aecb8c555) C:\WINDOWS\system32\Drivers\usbaapl.sys

19:53:45:796 0704 usbaudio (45a0d14b26c35497ad93bce7e15c9941) C:\WINDOWS\system32\drivers\usbaudio.sys

19:53:45:843 0704 usbccgp (bffd9f120cc63bcbaa3d840f3eef9f79) C:\WINDOWS\system32\DRIVERS\usbccgp.sys

19:53:45:859 0704 usbehci (15e993ba2f6946b2bfbbfcd30398621e) C:\WINDOWS\system32\DRIVERS\usbehci.sys

19:53:45:875 0704 usbhub (c72f40947f92cea56a8fb532edf025f1) C:\WINDOWS\system32\DRIVERS\usbhub.sys

19:53:45:921 0704 usbprint (a42369b7cd8886cd7c70f33da6fcbcf5) C:\WINDOWS\system32\DRIVERS\usbprint.sys

19:53:45:968 0704 usbscan (a6bc71402f4f7dd5b77fd7f4a8ddba85) C:\WINDOWS\system32\DRIVERS\usbscan.sys

19:53:46:000 0704 USBSTOR (6cd7b22193718f1d17a47a1cd6d37e75) C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS

19:53:46:015 0704 usbuhci (f8fd1400092e23c8f2f31406ef06167b) C:\WINDOWS\system32\DRIVERS\usbuhci.sys

19:53:46:031 0704 VgaSave (8a60edd72b4ea5aea8202daf0e427925) C:\WINDOWS\System32\drivers\vga.sys

19:53:46:062 0704 VolSnap (313b1a0d5db26dfe1c34a6c13b2ce0a7) C:\WINDOWS\system32\drivers\VolSnap.sys

19:53:46:265 0704 w22n51 (5bc494442773035da902ab30cdca11e7) C:\WINDOWS\system32\DRIVERS\w22n51.sys

19:53:46:375 0704 Wanarp (984ef0b9788abf89974cfed4bfbaacbc) C:\WINDOWS\system32\DRIVERS\wanarp.sys

19:53:46:406 0704 wdmaud (efd235ca22b57c81118c1aeb4798f1c1) C:\WINDOWS\system32\drivers\wdmaud.sys

19:53:46:484 0704 WpdUsb (cf4def1bf66f06964dc0d91844239104) C:\WINDOWS\system32\DRIVERS\wpdusb.sys

19:53:46:562 0704 WSTCODEC (d5842484f05e12121c511aa93f6439ec) C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS

19:53:46:609 0704 WudfPf (f15feafffbb3644ccc80c5da584e6311) C:\WINDOWS\system32\DRIVERS\WudfPf.sys

19:53:46:656 0704 WUDFRd (28b524262bce6de1f7ef9f510ba3985b) C:\WINDOWS\system32\DRIVERS\WUDFRd.sys

19:53:46:671 0704

19:53:46:671 0704 Completed

19:53:46:671 0704

19:53:46:671 0704 Results:

19:53:46:671 0704 Registry objects infected / cured / cured on reboot: 0 / 0 / 0

19:53:46:671 0704 File objects infected / cured / cured on reboot: 0 / 0 / 0

19:53:46:671 0704

19:53:46:671 0704 KLMD(ARK) unloaded successfully

_________________________

 

 

This log file is located at C:\rkill.log.

Please post this only if requested to by the person helping you.

Otherwise you can close this log when you wish.

Ran as MARTIAL on 21/07/2010 at 19:57:23.

 

 

Processes terminated by Rkill or while it was running:

 

 

C:\Documents and Settings\MARTIAL\Bureau\rkill.com

 

 

Rkill completed on 21/07/2010 at 19:57:32.

 

___________________

 

 

Malwarebytes' Anti-Malware 1.46

www.malwarebytes.org

 

Version de la base de données: 4336

 

Windows 5.1.2600 Service Pack 2

Internet Explorer 7.0.5730.11

 

22/07/2010 02:58:48

mbam-log-2010-07-22 (02-58-48).txt

 

Type d'examen: Examen complet (C:\|D:\|E:\|F:\|)

Elément(s) analysé(s): 261122

Temps écoulé: 6 heure(s), 38 minute(s), 27 seconde(s)

 

Processus mémoire infecté(s): 0

Module(s) mémoire infecté(s): 0

Clé(s) du Registre infectée(s): 0

Valeur(s) du Registre infectée(s): 0

Elément(s) de données du Registre infecté(s): 0

Dossier(s) infecté(s): 0

Fichier(s) infecté(s): 0

 

Processus mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Module(s) mémoire infecté(s):

(Aucun élément nuisible détecté)

 

Clé(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Valeur(s) du Registre infectée(s):

(Aucun élément nuisible détecté)

 

Elément(s) de données du Registre infecté(s):

(Aucun élément nuisible détecté)

 

Dossier(s) infecté(s):

(Aucun élément nuisible détecté)

 

Fichier(s) infecté(s):

(Aucun élément nuisible détecté)

pear Devil Member !

pear

Posté(e)
Posté(e) (modifié)

Ok!

 

 

 

 

Télécharger sur le bureauOTM

Double-clic sur OTM.exe pour le lancer.

Sous Vista,Clic droit sur le fichier ->Choisir Exécuter en tant qu' Administrateur

* Copiez /Collez les lignes ci dessous) en vert:

:Files

C:\Program Files\eChanblard\config\updater.exe

 

:Commands

[purity]

[emptytemp]

[Reboot]

Revenez dans OTM,

Clic droit sur la fenêtre "Paste Instructions for Items to be Moved" sous la barre jaune et choisir Coller(Paste).

* Click le bouton rouge Moveit!

* Fermez OTM

Votre Pc va redémarrer.

Rendez vous dans le dossier C:\_OTM\MovedFiles ,

ouvrez le dernier fichier .log

Copiez/collez en le contenu dans votre prochaine réponse

 

 

 

 

Télécharger gmer

 

- Cliquer sur le bouton "Download EXE"

- Sauvegardez sur le Bureau.

- Collez et sauvegardez ces instructions dans un fichier texte ou imprimez-les, car il faudra fermer le navigateur.

Avant toute utilisation de GMER, veuillez désactiver votre antivirus, antispyware sous peine de crash.

 

- Fermez les fenêtres de navigateur ouvertes.

- Lancez le fichier téléchargé par double clic(le nom comporte 8 chiffres/lettres aléatoires) ;

- Si l'outil lance un warning d'activité de rootkit et demande de faire un scan ; cliquez "NO"

- Dans la section de droite de la fenêtre de l'outil, Vérifiez que soient décochées les options suivantes :

Show All

Cochez juste " Sections" et "Files

gmer.jpg

- Cliquez sur le bouton "Scan" et patientez (cela peut prendre 10 minutes ou +)

Il peut arriver que GMER plante sans raison apparente.

Vous pouvez essayer ceci : décocher "Devices" dans un premier temps et repasser l'outil ;

si ça coince toujours, décocher en plus "Files" et ré-essayez un scan.

Lorsque les informations sur le scan s'affichent , les éléments détectés comme rootkit apparaissent en rouge dans chaque section.

 

Le bouton Copy permet de récupérer le résultat pour effectuer un copier/coller.

Le bouton Save permet l'enregistrement du rapport sur votre disque au format texte.

Modifié par pear
rossi_kawa Member

rossi_kawa

Posté(e)
  • Auteur
Posté(e)

Bonsoir Pear,

 

Comme demandé, voici les deux rapports OTM et Gmer.

 

A bientôt

 

 

All processes killed

========== FILES ==========

File/Folder C:\Program Files\eChanblard\config\updater.exe not found.

========== COMMANDS ==========

 

[EMPTYTEMP]

 

User: Administrateur

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 67 bytes

 

User: All Users

 

User: Default User

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 49286 bytes

 

User: LocalService

->Temp folder emptied: 66016 bytes

->Temporary Internet Files folder emptied: 147858 bytes

->Flash cache emptied: 606 bytes

 

User: MARTIAL

->Temp folder emptied: 36954115 bytes

->Temporary Internet Files folder emptied: 2060105 bytes

->Java cache emptied: 0 bytes

->Flash cache emptied: 405 bytes

 

User: NetworkService

->Temp folder emptied: 0 bytes

->Temporary Internet Files folder emptied: 722059 bytes

->Flash cache emptied: 1226 bytes

 

%systemdrive% .tmp files removed: 0 bytes

%systemroot% .tmp files removed: 39097 bytes

%systemroot%\System32 .tmp files removed: 22870016 bytes

%systemroot%\System32\dllcache .tmp files removed: 0 bytes

%systemroot%\System32\drivers .tmp files removed: 0 bytes

Windows Temp folder emptied: 6998596 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temp folder emptied: 51754340 bytes

%systemroot%\system32\config\systemprofile\Local Settings\Temporary Internet Files folder emptied: 33170 bytes

RecycleBin emptied: 0 bytes

 

Total Files Cleaned = 116,00 mb

 

 

OTM by OldTimer - Version 3.1.15.0 log created on 07222010_203023

 

Files moved on Reboot...

File C:\Documents and Settings\MARTIAL\Local Settings\Temp\fla71.tmp not found!

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\Z2K49Y1W\ads[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\Z2K49Y1W\afr[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\Z2K49Y1W\forte-suspicion-dinfection-t178111[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\Z2K49Y1W\povh[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\Z2K49Y1W\rectangle_300x250[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\I4TQZIEJ\afr[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\I4TQZIEJ\img[2].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\GO4IU0LA\AP_ADV_728x90[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\GO4IU0LA\ban_home_728x90[1].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\Content.IE5\2Y5LN00R\img[3].htm moved successfully.

C:\Documents and Settings\MARTIAL\Local Settings\Temporary Internet Files\AntiPhishing\A0AB7674-8D67-4F4D-B5E1-96FAEADFB79D.dat moved successfully.

 

Registry entries deleted on Reboot...

 

________________________

 

 

GMER 1.0.15.15281 - GMER - Rootkit Detector and Remover

Rootkit scan 2010-07-22 22:54:00

Windows 5.1.2600 Service Pack 2

Running: hu081sf6.exe; Driver: C:\DOCUME~1\MARTIAL\LOCALS~1\Temp\pwtdypow.sys

 

 

---- Kernel code sections - GMER 1.0.15 ----

 

PAGENDSM NDIS.sys!NdisMIndicateStatus F784AA5F 6 Bytes JMP A10DBED0 \SystemRoot\system32\drivers\fwdrv.sys (Sunbelt Kerio Firewall FWDRV/Sunbelt Software)

 

---- User code sections - GMER 1.0.15 ----

 

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\DVDRAMSV.exe[196] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTRTSVC\0\FTRTSVC.exe[236] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[316] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[316] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[316] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Java\jre6\bin\jqs.exe[340] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000301A8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00030090

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00030694

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000302C0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00030234

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00030004

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0003011C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000304F0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0003057C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000303D8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0003034C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00030464

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00030608

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000307AC

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00030720

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000308C4

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00030838

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WS2_32.dll!connect 719F406A 5 Bytes JMP 00030950

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00030F54

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00030FE0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00030D24

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00030DB0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00030E3C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4ss.exe[360] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00030EC8

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Fichiers communs\Microsoft Shared\VS7DEBUG\MDM.EXE[380] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001408C4

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00140838

.text C:\Program Files\OrangeHSS\connectivity\connectivitymanager.exe[436] WS2_32.dll!connect 719F406A 5 Bytes JMP 00140950

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\taskmgr.exe[452] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\taskmgr.exe[452] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\taskmgr.exe[452] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\taskmgr.exe[452] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\taskmgr.exe[452] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\taskmgr.exe[452] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\System32\svchost.exe[464] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\System32\svchost.exe[464] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\System32\svchost.exe[464] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\svchost.exe[464] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\System32\svchost.exe[464] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\System32\svchost.exe[464] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00140F54

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00140FE0

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00140D24

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00140DB0

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00140E3C

.text C:\Program Files\OrangeHSS\Deskboard\deskboard.exe[504] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00140EC8

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\System32\svchost.exe[516] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\System32\svchost.exe[516] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\System32\svchost.exe[516] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\svchost.exe[516] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\System32\svchost.exe[516] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\System32\svchost.exe[516] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\systray\systrayapp.exe[564] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\RegSrvc.exe[596] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\RegSrvc.exe[596] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\RegSrvc.exe[596] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001601A8

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00160090

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00160694

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001602C0

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00160234

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00160004

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0016011C

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001604F0

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateThread 7C810647 5 Bytes JMP 0016057C

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001603D8

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0016034C

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!WinExec 7C86158D 5 Bytes JMP 00160464

.text C:\WINDOWS\system32\csrss.exe[624] KERNEL32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00160608

.text C:\WINDOWS\system32\csrss.exe[624] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001607AC

.text C:\WINDOWS\system32\csrss.exe[624] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00160720

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00070004

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0007011C

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000704F0

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0007057C

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000703D8

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0007034C

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00070464

.text C:\WINDOWS\system32\winlogon.exe[652] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00070608

.text C:\WINDOWS\system32\winlogon.exe[652] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000707AC

.text C:\WINDOWS\system32\winlogon.exe[652] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00070720

.text C:\WINDOWS\system32\winlogon.exe[652] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000708C4

.text C:\WINDOWS\system32\winlogon.exe[652] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00070838

.text C:\WINDOWS\system32\winlogon.exe[652] WS2_32.dll!connect 719F406A 5 Bytes JMP 00070950

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\services.exe[696] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\services.exe[696] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\services.exe[696] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\lsass.exe[708] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\lsass.exe[708] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\lsass.exe[708] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\lsass.exe[708] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\lsass.exe[708] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\lsass.exe[708] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[816] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[816] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[816] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\Ati2evxx.exe[892] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\Ati2evxx.exe[892] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\Ati2evxx.exe[892] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[956] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[956] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[956] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\svchost.exe[956] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\svchost.exe[956] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\svchost.exe[956] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\System32\svchost.exe[996] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\System32\svchost.exe[996] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\System32\svchost.exe[996] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\svchost.exe[996] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\System32\svchost.exe[996] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\System32\svchost.exe[996] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00080F54

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00080FE0

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00080D24

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00080DB0

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00080E3C

.text C:\WINDOWS\System32\svchost.exe[996] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00080EC8

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[1032] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[1032] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[1032] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[1196] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\WINDOWS\system32\ZCfgSvc.exe[1204] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\S24EvMon.exe[1236] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\S24EvMon.exe[1236] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\S24EvMon.exe[1236] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[1380] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[1380] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\svchost.exe[1380] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\Explorer.EXE[1440] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\Explorer.EXE[1440] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\Explorer.EXE[1440] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00080F54

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00080FE0

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00080D24

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00080DB0

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00080E3C

.text C:\WINDOWS\Explorer.EXE[1440] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00080EC8

.text C:\WINDOWS\Explorer.EXE[1440] ws2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\Explorer.EXE[1440] ws2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\Explorer.EXE[1440] ws2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[1484] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[1484] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\svchost.exe[1484] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\svchost.exe[1484] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\svchost.exe[1484] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00080F54

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00080FE0

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00080D24

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00080DB0

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00080E3C

.text C:\WINDOWS\system32\svchost.exe[1484] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00080EC8

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Documents and Settings\MARTIAL\Bureau\hu081sf6.exe[1608] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001408C4

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00140838

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WS2_32.dll!connect 719F406A 5 Bytes JMP 00140950

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00140F54

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00140FE0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00140D24

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00140DB0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00140E3C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\CoreCom.exe[1652] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00140EC8

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\spoolsv.exe[1720] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\spoolsv.exe[1720] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\spoolsv.exe[1720] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\spoolsv.exe[1720] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\spoolsv.exe[1720] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Avira\AntiVir Desktop\sched.exe[1756] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\svchost.exe[1872] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\svchost.exe[1872] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\svchost.exe[1872] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00080F54

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00080FE0

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00080D24

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00080DB0

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00080E3C

.text C:\WINDOWS\system32\svchost.exe[1872] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00080EC8

.text C:\WINDOWS\system32\svchost.exe[1872] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\svchost.exe[1872] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\svchost.exe[1872] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] ole32.dll!OleLoadFromStream 774EA257 5 Bytes JMP 30F8D300 C:\Program Files\Fichiers communs\Microsoft Shared\office11\mso.dll (Microsoft Office 2003 component/Microsoft Corporation)

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00140F54

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00140FE0

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00140D24

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00140DB0

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00140E3C

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00140EC8

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] ws2_32.dll!socket 719F3B91 5 Bytes JMP 001408C4

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] ws2_32.dll!bind 719F3E00 5 Bytes JMP 00140838

.text C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE[1912] ws2_32.dll!connect 719F406A 5 Bytes JMP 00140950

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Avira\AntiVir Desktop\avguard.exe[1972] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Fichiers communs\Apple\Mobile Device Support\AppleMobileDeviceService.exe[1984] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Bonjour\mDNSResponder.exe[1996] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe[2020] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00130F54

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00130FE0

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00130D24

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00130DB0

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00130E3C

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00130EC8

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe[2044] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\wbem\wmiapsrv.exe[2088] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\System32\alg.exe[2156] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\System32\alg.exe[2156] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\System32\alg.exe[2156] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\alg.exe[2156] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\System32\alg.exe[2156] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\System32\alg.exe[2156] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[2220] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\WINDOWS\system32\1XConfig.exe[2480] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\WINDOWS\system32\1XConfig.exe[2480] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\WINDOWS\system32\1XConfig.exe[2480] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\WINDOWS\system32\1XConfig.exe[2480] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\WINDOWS\system32\1XConfig.exe[2480] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\WINDOWS\system32\1XConfig.exe[2480] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00130004

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0013011C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001304F0

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0013057C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001303D8

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0013034C

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00130464

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00130608

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001307AC

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00130720

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001308C4

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00130838

.text C:\Program Files\Sunbelt Software\Personal Firewall\kpf4gui.exe[2668] WS2_32.dll!connect 719F406A 5 Bytes JMP 00130950

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\connectivity\CoreCom\OraConfigRecover.exe[2692] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\FTCOMModule\0\FTCOMModule.exe[2704] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\Program Files\Microsoft\Office Live\OfficeLiveSignIn.exe[2784] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\System32\svchost.exe[2860] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\System32\svchost.exe[2860] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\System32\svchost.exe[2860] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\WINDOWS\System32\svchost.exe[2860] WS2_32.dll!socket 719F3B91 5 Bytes JMP 000808C4

.text C:\WINDOWS\System32\svchost.exe[2860] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00080838

.text C:\WINDOWS\System32\svchost.exe[2860] WS2_32.dll!connect 719F406A 5 Bytes JMP 00080950

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00070004

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0007011C

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000704F0

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0007057C

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000703D8

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0007034C

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00070464

.text C:\WINDOWS\system32\wscntfy.exe[3512] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00070608

.text C:\WINDOWS\system32\wscntfy.exe[3512] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000707AC

.text C:\WINDOWS\system32\wscntfy.exe[3512] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00070720

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\notepad.exe[3628] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\notepad.exe[3628] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\notepad.exe[3628] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe[3756] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\TOSHIBA\Power Management\CePMTray.exe[3812] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe[3828] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\TOSHIBA\TouchPad\TPTray.exe[3836] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\Program Files\Winamp\winampa.exe[3852] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\Program Files\Winamp\winampa.exe[3852] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\Program Files\Winamp\winampa.exe[3852] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\Avira\AntiVir Desktop\avgnt.exe[3880] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00140F54

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00140FE0

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00140D24

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00140DB0

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00140E3C

.text C:\Program Files\Java\jre6\bin\jusched.exe[3896] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00140EC8

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\QuickTime\QTTask.exe[3940] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\QuickTime\QTTask.exe[3940] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\QuickTime\QTTask.exe[3940] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00080004

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0008011C

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 000804F0

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0008057C

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 000803D8

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0008034C

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00080464

.text C:\WINDOWS\system32\ctfmon.exe[3964] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00080608

.text C:\WINDOWS\system32\ctfmon.exe[3964] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 000807AC

.text C:\WINDOWS\system32\ctfmon.exe[3964] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00080720

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WS2_32.dll!socket 719F3B91 5 Bytes JMP 001408C4

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WS2_32.dll!bind 719F3E00 5 Bytes JMP 00140838

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WS2_32.dll!connect 719F406A 5 Bytes JMP 00140950

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetConnectA 404BB0D2 5 Bytes JMP 00140F54

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetConnectW 404BC2C0 5 Bytes JMP 00140FE0

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetOpenA 404C3081 5 Bytes JMP 00140D24

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetOpenW 404C36B1 5 Bytes JMP 00140DB0

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetOpenUrlA 404C6F5A 5 Bytes JMP 00140E3C

.text C:\Program Files\OrangeHSS\Launcher\Launcher.exe[3984] WININET.dll!InternetOpenUrlW 40508439 5 Bytes JMP 00140EC8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001401A8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00140090

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00140694

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001402C0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00140234

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!VirtualAlloc 7C809A61 5 Bytes JMP 00140004

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!VirtualAllocEx 7C809A82 5 Bytes JMP 0014011C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateRemoteThread 7C81043C 5 Bytes JMP 001404F0

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateThread 7C810647 5 Bytes JMP 0014057C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateProcessInternalW 7C819527 5 Bytes JMP 001403D8

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!CreateProcessInternalA 7C81DDE6 5 Bytes JMP 0014034C

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!WinExec 7C86158D 5 Bytes JMP 00140464

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] kernel32.dll!SetThreadContext 7C862C89 5 Bytes JMP 00140608

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] USER32.dll!SetWindowsHookExW 7E3ADDB5 5 Bytes JMP 001407AC

.text C:\PROGRA~1\FICHIE~1\France Telecom\Shared Modules\AlertModule\0\AlertModule.exe[4012] USER32.dll!SetWindowsHookExA 7E3B11D1 5 Bytes JMP 00140720

 

---- EOF - GMER 1.0.15 ----

pear Devil Member !

pear

Posté(e)
Posté(e) (modifié)

Toutes les dernières recherches sont vaines.

 

 

Sous Vista, désactivez l'UAC

Télécharger Kaspersky Virus Removal Tool(VRT)

Le fichier fait + de 70M°, soyez patient.

 

Très simple à utiliser,Kaspersky Virus Removal Tool n'est pas un antivirus ou un outil de surveillance,

Il n'y a pas non plus de mise-à-jour automatique, il vous faudra donc télécharger la nouvelle version, qui est quotidiennement mise à jour, et l'installer à chaque fois que vous désirez l'utiliser.

Cliquer sur le fichier téléchargé pour installer VRT.

 

img-154800hyn5a.jpg

A On threat détection(si un malware est détecté)

Choisissez, en bas Disinfect,delete if cannot disinfected

Sélectionner les fichiers ou répertoires à analyser (disque dur, périphériques ou documents spécifiques) puis de lancer le processus Start Scan.

 

A la fin du scan:

Cliquer sur"Report" pour voir et enregistrer le rapport à poster.

Ensuite taper sur Exit pour désinstaller l'outil

 

 

Cette vérification faite,on va s'orienter vers des problèmes matériels:

 

Un lien vers une page internet ne fonctionne pas:

 

Désactivation du HTTP 1.1 --> Menus Outils --> Option Internet --> Avancé --> Paramètres HTTP 1.1 --> Décocher les 2 cases

 

Si vous utilisez Malewares'Bytes, vérifiez que la fonction "IP protection" n'est pas active.

 

Copier /coller dans le bloc notes.

Enregistrer sur le bureau sous explor.bat

Double clic sur le fichier .bat pour le lancer.

@echo off

regsvr32 Urlmon.dll /s

regsvr32 Shdocvw.dll /s

regsvr32 Oleaut32.dll /s

regsvr32 Actxprxy.dll /s

regsvr32 Mshtml.dll /s

regsvr32 Shell32.dll /s

regSvr32 Browseui.dll /s

et réessayez.

 

Si cela ne suffisait pas:

 

Copier/coller ce qui suit dans le bloc notes,

sans ligne blanche au début.

Enregistrez sur le bureau sous regis.reg.

Cliquez droit sur le fichier ->fusionner

Acceptez la modification du Régistre:

Windows Registry Editor Version 5.00

 

[HKEY_CLASSES_ROOT\http\shell]

@="open"

[HKEY_CLASSES_ROOT\http\shell\open]

[HKEY_CLASSES_ROOT\http\shell\open\command]

@="\"C:\\Program Files\\Internet Explorer\\iexplore.exe\" -nohome"

[HKEY_CLASSES_ROOT\http\shell\open\ddeexec]

@="\"%1\",,-1,0,,,,"

"NoActivateHandler"=""

[HKEY_CLASSES_ROOT\http\shell\open\ddeexec\Application]

@="IExplore"

[HKEY_CLASSES_ROOT\http\shell\open\ddeexec\Topic]

@="WWW_OpenURL"

En cas d'insuccès:

Démarrer->Exécuter

tapez sfc /scannow

le cd Xp peut être exigé.

Modifié par pear
rossi_kawa Member

rossi_kawa

Posté(e)
  • Auteur
Posté(e)

Bonjour Pear,

 

J'ai fait toutes les manips indiquées sans problèmes particuliers à relever, mais j'ai toujours une erreur 404 pour le lien MBAM que tu m'avais indiqué dans ton message du 21 juillet matin (à enregister sous le nom bitruc.com).

 

Voici le rapport KVRT, vierge d'après moi.

 

Que peut-on faire de plus???

 

A bientôt

 

 

Autoscan: completed 8 hours ago (events: 2, objects: 344823, time: 03:26:29)

23/07/2010 21:48:23 Task started

24/07/2010 01:14:53 Task completed

pear Devil Member !

pear

Posté(e)
Posté(e)

Bonjour,

j'ai toujours une erreur 404 pour le lien MBAM que tu m'avais indiqué dans ton message du 21 juillet matin (à enregister sous le nom bitruc.com).

 

Vous avez pu charger Mbam autrement et il a bien fonctionné.c'est ce qui compte.

Oubliez le lien qui ne fonctionne pas.

 

Que peut-on faire de plus???

Je ne vois rien à faire de plus

Rejoindre la conversation

Vous pouvez publier maintenant et vous inscrire plus tard. Si vous avez un compte, connectez-vous maintenant pour publier avec votre compte.
Remarque : votre message nécessitera l’approbation d’un modérateur avant de pouvoir être visible.

Invité
Répondre à ce sujet…

×   Collé en tant que texte enrichi.   Coller en tant que texte brut à la place

  Seulement 75 émoticônes maximum sont autorisées.

×   Votre lien a été automatiquement intégré.   Afficher plutôt comme un lien

×   Votre contenu précédent a été rétabli.   Vider l’éditeur

×   Vous ne pouvez pas directement coller des images. Envoyez-les depuis votre ordinateur ou insérez-les depuis une URL.

×
 Partager
Aller sur la liste des sujets

  • En ligne récemment   0 membre est en ligne

    • Aucun utilisateur enregistré regarde cette page.
×
×
  • Créer...