rendered paste bodyGMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-26 10:13:24
Windows 6.0.6001 Service Pack 1
---- System - GMER 1.0.15 ----
SSDT 87108D90 ZwAlertResumeThread
SSDT 87108E50 ZwAlertThread
SSDT 87321678 ZwAllocateVirtualMemory
SSDT 86F5C1D0 ZwAlpcConnectPort
SSDT 87108578 ZwAssignProcessToJobObject
SSDT 87108B20 ZwCreateMutant
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcess [0x881A3282]
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateProcessEx [0x881A3474]
SSDT 874B3DB0 ZwCreateSymbolicLinkObject
SSDT 87320B00 ZwCreateThread
SSDT 87108658 ZwDebugActiveProcess
SSDT 873217D0 ZwDuplicateObject
SSDT 873214D8 ZwFreeVirtualMemory
SSDT 87108C10 ZwImpersonateAnonymousToken
SSDT 87108CD0 ZwImpersonateThread
SSDT 86F323C0 ZwLoadDriver
SSDT 873213F8 ZwMapViewOfSection
SSDT 87108A40 ZwOpenEvent
SSDT 87321970 ZwOpenProcess
SSDT 86B2B568 ZwOpenProcessToken
SSDT 87108880 ZwOpenSection
SSDT 873218A0 ZwOpenThread
SSDT 874B3F80 ZwProtectVirtualMemory
SSDT 86BEC208 ZwResumeThread
SSDT 873211E0 ZwSetContextThread
SSDT 873212A0 ZwSetInformationProcess
SSDT 87108738 ZwSetSystemInformation
SSDT 87108960 ZwSuspendProcess
SSDT 87108F10 ZwSuspendThread
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwTerminateProcess [0x881A2F32]
SSDT 87108FD0 ZwTerminateThread
SSDT 86F2FF60 ZwUnmapViewOfSection
SSDT 873215A8 ZwWriteVirtualMemory
SSDT 874B3EA0 ZwCreateThreadEx
SSDT \SystemRoot\system32\drivers\PCTCore.sys (PC Tools KDS Core Driver/PC Tools) ZwCreateUserProcess [0x881A367C]
---- Kernel code sections - GMER 1.0.15 ----
.text ntkrnlpa.exe!KeSetTimerEx + 350 81EBF914 8 Bytes [90, 8D, 10, 87, 50, 8E, 10, ...]
.text ntkrnlpa.exe!KeSetTimerEx + 364 81EBF928 4 Bytes [78, 16, 32, 87]
.text ntkrnlpa.exe!KeSetTimerEx + 370 81EBF934 4 Bytes [D0, C1, F5, 86]
.text ntkrnlpa.exe!KeSetTimerEx + 3C4 81EBF988 4 Bytes [78, 85, 10, 87]
.text ntkrnlpa.exe!KeSetTimerEx + 428 81EBF9EC 4 Bytes [20, 8B, 10, 87]
.text ...
? C:\Windows\system32\Drivers\mchInjDrv.sys The system cannot find the file specified. !
---- User code sections - GMER 1.0.15 ----
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Users\jeffrey\Desktop\jlpdwt7g.exe[116] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\svchost.exe[376] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[376] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[376] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\SMINST\BLService.exe[456] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\SMINST\BLService.exe[456] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\SMINST\BLService.exe[456] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\CyberLink\Shared Files\RichVideo.exe[464] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\csrss.exe[500] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\csrss.exe[500] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\csrss.exe[500] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[544] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wininit.exe[544] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\wininit.exe[544] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\csrss.exe[552] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\csrss.exe[552] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\csrss.exe[552] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\winlogon.exe[600] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\winlogon.exe[600] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\winlogon.exe[600] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Common Files\Adobe\Updater6\Adobe_Updater.exe[628] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\services.exe[632] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\services.exe[632] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\services.exe[632] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\lsass.exe[648] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\lsass.exe[648] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\lsass.exe[648] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\lsm.exe[656] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\lsm.exe[656] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\lsm.exe[656] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\svchost.exe[744] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[744] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\svchost.exe[744] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\svchost.exe[816] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[816] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[816] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Spyware Doctor\pctsAuxs.exe[824] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\svchost.exe[880] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[880] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\svchost.exe[1048] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1048] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\svchost.exe[1048] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\svchost.exe[1088] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[1088] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\svchost.exe[1088] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\svchost.exe[1100] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1100] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[1100] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Hewlett-Packard\HP wireless Assistant\WiFiMsg.EXE[1192] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\svchost.exe[1248] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[1248] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] kernel32.dll!CreateThread + 1A 75E246E2 4 Bytes CALL 0044AD11 C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
.text C:\Windows\system32\svchost.exe[1372] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1372] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[1372] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\WLANExt.exe[1496] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\WLANExt.exe[1496] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\WLANExt.exe[1496] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\spoolsv.exe[1568] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\spoolsv.exe[1568] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\spoolsv.exe[1568] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\svchost.exe[1620] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[1620] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[1620] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\taskeng.exe[1844] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[1844] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\taskeng.exe[1844] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Windows\system32\wbem\unsecapp.exe[1876] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\Dwm.exe[2176] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\Dwm.exe[2176] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\Dwm.exe[2176] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\Explorer.EXE[2216] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\Explorer.EXE[2216] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\Explorer.EXE[2216] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Hewlett-Packard\Shared\HpqToaster.exe[2324] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\taskeng.exe[2396] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Windows\system32\taskeng.exe[2396] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[2488] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\System32\hkcmd.exe[2504] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Windows\System32\hkcmd.exe[2504] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\System32\igfxpers.exe[2632] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Windows\System32\igfxpers.exe[2632] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\HP\QuickPlay\QPService.exe[2660] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe[2676] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\HP\Digital Imaging\bin\HpqSRmon.exe[2684] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\HP\HP Software Update\hpwuSchd2.exe[2704] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe[2712] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Synaptics\SynTP\SynTPHelper.exe[2728] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Java\jre6\bin\jusched.exe[2752] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Registry Mechanic\RMTray.exe[2896] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Windows Media Player\wmpnscfg.exe[2904] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text C:\Windows\system32\svchost.exe[3172] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\svchost.exe[3172] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\svchost.exe[3172] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Viewpoint\Common\ViewpointService.exe[3200] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\System32\svchost.exe[3244] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\System32\svchost.exe[3244] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\System32\svchost.exe[3244] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] kernel32.dll!CreateThread + 1A 75E246E2 4 Bytes CALL 0044AB89 C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Spyware Doctor\pctsTray.exe[3264] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\SearchIndexer.exe[3284] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\SearchIndexer.exe[3284] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\SearchIndexer.exe[3284] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\Com4QLBEx.exe[3344] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\DRIVERS\xaudio.exe[3364] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\DRIVERS\xaudio.exe[3364] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\DRIVERS\xaudio.exe[3364] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe[3424] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Windows Media Player\wmpnetwk.exe[3496] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[3500] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[3500] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\wbem\wmiprvse.exe[3500] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Windows\system32\igfxsrvc.exe[3528] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
.text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] KERNEL32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe[4332] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] kernel32.dll!LoadLibraryExW 75E030C3 6 Bytes JMP 5F070F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowsHookExW 76327B69 6 Bytes JMP 5F0A0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetForegroundWindow 7632B5F5 6 Bytes JMP 5F0D0F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowPos 763321FE 3 Bytes [FF, 25, 1E]
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowPos + 4 76332202 2 Bytes [12, 5F]
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!SetWindowsHookExA 7634BB0E 6 Bytes JMP 5F040F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!ChangeDisplaySettingsExA 763513E2 6 Bytes JMP 5F140F5A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5392] USER32.dll!ChangeDisplaySettingsExW 7636A981 6 Bytes JMP 5F170F5A
---- User IAT/EAT - GMER 1.0.15 ----
IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044AE68] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsSvc.exe[1332] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044AE68] C:\Program Files\Spyware Doctor\pctsSvc.exe (PC Tools Security Service/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsTray.exe[3264] @ C:\Windows\system32\shell32.dll [KERNEL32.dll!QueueUserWorkItem] [0044ACE0] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
IAT C:\Program Files\Spyware Doctor\pctsTray.exe[3264] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!QueueUserWorkItem] [0044ACE0] C:\Program Files\Spyware Doctor\pctsTray.exe (PC Tools Tray Application/PC Tools)
---- Devices - GMER 1.0.15 ----
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS
AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS
AttachedDevice \Driver\tdx \Device\RawIp SYMTDI.SYS
---- EOF - GMER 1.0.15 ----