Kinth
18-06-2007, 19:58
Ho il seguente problema,
quando avvio windows xp e apro il task manager noto
che la ram allocata è perennemente sui 1400Mb (ho 1gb di ram)
ora ho provato a fare una scansione con avast e ha trovato
uno worm che era stato messo in quarantena da prevx2, l ho eliminato
ma il problema persiste.
Ho effettuato lo scan con hjackthis e gmer
eccone i log:
Logfile of HijackThis v1.99.1
Scan saved at 17.07.26, on 18/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Prevx2\PXConsole.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.266\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/italian
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [BDOESRV] "C:\Programmi\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\progra~1\softwin\bitdef~1\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"
O4 - HKLM\..\Run: [BDMCon] c:\progra~1\softwin\bitdef~1\bdmcon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISS_SIP] C:\Programmi\Anti Keylogger Elite\AKE.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programmi\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [AdobeUpdater] C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Acrobat.lnk = ?
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programmi\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Gmer log
GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-06-18 20:23:53
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.12 ----
SSDT pxfsf.sys ZwAlertResumeThread
SSDT pxfsf.sys ZwAllocateUserPhysicalPages
SSDT pxfsf.sys ZwAllocateVirtualMemory
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwClose
SSDT pxfsf.sys ZwCompactKeys
SSDT pxfsf.sys ZwCompressKey
SSDT pxfsf.sys ZwCreateDirectoryObject
SSDT pxfsf.sys ZwCreateEvent
SSDT pxfsf.sys ZwCreateEventPair
SSDT pxfsf.sys ZwCreateFile
SSDT pxfsf.sys ZwCreateIoCompletion
SSDT pxfsf.sys ZwCreateJobObject
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwCreateKey
SSDT pxfsf.sys ZwCreateMailslotFile
SSDT pxfsf.sys ZwCreateMutant
SSDT pxfsf.sys ZwCreateNamedPipeFile
SSDT pxfsf.sys ZwCreatePort
SSDT pxfsf.sys ZwCreateProcess
SSDT pxfsf.sys ZwCreateProcessEx
SSDT pxfsf.sys ZwCreateSection
SSDT pxfsf.sys ZwCreateSemaphore
SSDT pxfsf.sys ZwCreateSymbolicLinkObject
SSDT pxfsf.sys ZwCreateThread
SSDT pxfsf.sys ZwCreateTimer
SSDT pxfsf.sys ZwCreateToken
SSDT pxfsf.sys ZwDeleteFile
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteValueKey
SSDT pxfsf.sys ZwDeviceIoControlFile
SSDT pxfsf.sys ZwDuplicateObject
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateValueKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwFlushKey
SSDT pxfsf.sys ZwFreeUserPhysicalPages
SSDT pxfsf.sys ZwFreeVirtualMemory
SSDT pxfsf.sys ZwImpersonateAnonymousToken
SSDT pxfsf.sys ZwImpersonateThread
SSDT pxfsf.sys ZwLoadDriver
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwLoadKey
SSDT pxfsf.sys ZwLoadKey2
SSDT pxfsf.sys ZwLockRegistryKey
SSDT pxfsf.sys ZwLockVirtualMemory
SSDT pxfsf.sys ZwMapViewOfSection
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdfsdrv.sys ZwOpenFile
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwOpenKey
SSDT pxfsf.sys ZwOpenProcess
SSDT pxfsf.sys ZwOpenProcessToken
SSDT pxfsf.sys ZwOpenSection
SSDT pxfsf.sys ZwOpenThread
SSDT pxfsf.sys ZwOpenThreadToken
SSDT pxfsf.sys ZwProtectVirtualMemory
SSDT pxfsf.sys ZwQueryInformationProcess
SSDT pxfsf.sys ZwQueryInformationThread
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryKey
SSDT pxfsf.sys ZwQueryMultipleValueKey
SSDT pxfsf.sys ZwQueryOpenSubKeys
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryValueKey
SSDT pxfsf.sys ZwQueueApcThread
SSDT pxfsf.sys ZwReadFile
SSDT pxfsf.sys ZwReadVirtualMemory
SSDT pxfsf.sys ZwRenameKey
SSDT pxfsf.sys ZwReplaceKey
SSDT pxfsf.sys ZwRestoreKey
SSDT pxfsf.sys ZwResumeProcess
SSDT pxfsf.sys ZwResumeThread
SSDT pxfsf.sys ZwSaveKey
SSDT pxfsf.sys ZwSaveKeyEx
SSDT pxfsf.sys ZwSaveMergedKeys
SSDT pxfsf.sys ZwSetContextThread
SSDT pxfsf.sys ZwSetInformationKey
SSDT pxfsf.sys ZwSetInformationProcess
SSDT pxfsf.sys ZwSetInformationThread
SSDT pxfsf.sys ZwSetSystemInformation
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwSetValueKey
SSDT pxfsf.sys ZwSuspendProcess
SSDT pxfsf.sys ZwSuspendThread
SSDT pxfsf.sys ZwSystemDebugControl
SSDT pxfsf.sys ZwTerminateJobObject
SSDT pxfsf.sys ZwTerminateProcess
SSDT pxfsf.sys ZwTerminateThread
SSDT pxfsf.sys ZwUnloadDriver
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwUnloadKey
SSDT pxfsf.sys ZwUnloadKeyEx
SSDT pxfsf.sys ZwUnlockVirtualMemory
SSDT pxfsf.sys ZwUnmapViewOfSection
SSDT pxfsf.sys ZwWriteFile
SSDT pxfsf.sys ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.12 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 23B4 805010B8 24 Bytes [ 79, 68, 3C, F7, 83, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 16 Bytes [ 5E, 69, 52, B9, BF, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23E4 805010E8 12 Bytes [ DD, 68, 3C, F7, E7, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23F4 805010F8 24 Bytes [ FB, 68, 3C, F7, 05, 69, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 24B0 805011B4 12 Bytes [ A5, 69, 3C, F7, 58, 6F, 52, ... ]
.text ...
? C:\WINDOWS\system32\DRIVERS\update.sys
---- User code sections - GMER 1.0.12 ----
.text C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe[468] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\services.exe[612] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Softwin\BitDefender9\bdoesrv.exe[1484] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\nvsvc32.exe[1640] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00613090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 00612D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 00612CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 00613020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 00612DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!send 71A3428A 5 Bytes JMP 00612AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 00612D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 00612A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 00613060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!accept 71A41028 5 Bytes JMP 00612F30 C:\WINDOWS\system32\sockspy.dll
.text C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe[1684] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\soundman.exe[1792] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe[1824] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\rundll32.exe[2288] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\QuickTime\qttask.exe[2412] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 003C2D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 003C2CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 003C3020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 003C2DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!send 71A3428A 5 Bytes JMP 003C2AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 003C2D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 003C2A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 003C3060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!accept 71A41028 5 Bytes JMP 003C2F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\ctfmon.exe[2476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\System32\sockspy.dll
.text C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe[2780] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe[2980] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe[3076] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\WinRAR\WinRAR.exe[3476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.344\gmer.exe[3504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
---- EOF - GMER 1.0.12 ----
quando avvio windows xp e apro il task manager noto
che la ram allocata è perennemente sui 1400Mb (ho 1gb di ram)
ora ho provato a fare una scansione con avast e ha trovato
uno worm che era stato messo in quarantena da prevx2, l ho eliminato
ma il problema persiste.
Ho effettuato lo scan con hjackthis e gmer
eccone i log:
Logfile of HijackThis v1.99.1
Scan saved at 17.07.26, on 18/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Prevx2\PXConsole.exe
C:\Programmi\WinRAR\WinRAR.exe
C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.266\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://mystart.incredimail.com/italian
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Supporto di collegamento per Adobe PDF Reader - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programmi\File comuni\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Malicious Scripts Scanner - {55EA1964-F5E4-4D6A-B9B2-125B37655FCB} - C:\Documents and Settings\All Users\Dati applicazioni\Prevx\pxbho.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Programmi\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [BDOESRV] "C:\Programmi\Softwin\BitDefender9\bdoesrv.exe"
O4 - HKLM\..\Run: [BDNewsAgent] "C:\progra~1\softwin\bitdef~1\bdnagent.exe"
O4 - HKLM\..\Run: [BDSwitchAgent] "C:\progra~1\softwin\bitdef~1\bdswitch.exe"
O4 - HKLM\..\Run: [BDMCon] c:\progra~1\softwin\bitdef~1\bdmcon.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [ISS_SIP] C:\Programmi\Anti Keylogger Elite\AKE.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programmi\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PrevxOne] "C:\Programmi\Prevx2\PXConsole.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [IncrediMail] C:\Programmi\IncrediMail\bin\IncMail.exe /c
O4 - HKCU\..\Run: [AdobeUpdater] C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe
O4 - Startup: Adobe Gamma.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AdobeCollabSync.exe
O4 - Global Startup: Avvio veloce di Adobe Acrobat.lnk = ?
O4 - Global Startup: Avvio veloce di Adobe Reader.lnk = C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programmi\Microsoft Office\Office\OSA9.EXE
O8 - Extra context menu item: Aggiungi a PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti destinazione link in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti destinazione link in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Converti i link selezionati in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Converti i link selezionati in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Converti in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in Adobe PDF - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Converti selezione in file PDF esistente - res://C:\Programmi\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/IT-IT/a-UNO1/GAME_UNO1.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Programmi\File comuni\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe" /service (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Update Service\livesrv.exe" /service (file missing)
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Prevx Agent (PREVXAgent) - Unknown owner - C:\Programmi\Prevx2\PXAgent.exe" -f (file missing)
O23 - Service: SiSoftware Database Agent Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\Win32\RpcDataSrv.exe
O23 - Service: SiSoftware Sandra Agent Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite XI.SP1a\RpcSandraSrv.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - Unknown owner - C:\Programmi\Softwin\BitDefender9\vsserv.exe" /service (file missing)
O23 - Service: BitDefender Communicator (XCOMM) - Unknown owner - C:\Programmi\File comuni\Softwin\BitDefender Communicator\xcommsvr.exe" /service (file missing)
Gmer log
GMER 1.0.12.12244 - http://www.gmer.net
Rootkit scan 2007-06-18 20:23:53
Windows 5.1.2600 Service Pack 2
---- System - GMER 1.0.12 ----
SSDT pxfsf.sys ZwAlertResumeThread
SSDT pxfsf.sys ZwAllocateUserPhysicalPages
SSDT pxfsf.sys ZwAllocateVirtualMemory
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwClose
SSDT pxfsf.sys ZwCompactKeys
SSDT pxfsf.sys ZwCompressKey
SSDT pxfsf.sys ZwCreateDirectoryObject
SSDT pxfsf.sys ZwCreateEvent
SSDT pxfsf.sys ZwCreateEventPair
SSDT pxfsf.sys ZwCreateFile
SSDT pxfsf.sys ZwCreateIoCompletion
SSDT pxfsf.sys ZwCreateJobObject
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwCreateKey
SSDT pxfsf.sys ZwCreateMailslotFile
SSDT pxfsf.sys ZwCreateMutant
SSDT pxfsf.sys ZwCreateNamedPipeFile
SSDT pxfsf.sys ZwCreatePort
SSDT pxfsf.sys ZwCreateProcess
SSDT pxfsf.sys ZwCreateProcessEx
SSDT pxfsf.sys ZwCreateSection
SSDT pxfsf.sys ZwCreateSemaphore
SSDT pxfsf.sys ZwCreateSymbolicLinkObject
SSDT pxfsf.sys ZwCreateThread
SSDT pxfsf.sys ZwCreateTimer
SSDT pxfsf.sys ZwCreateToken
SSDT pxfsf.sys ZwDeleteFile
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwDeleteValueKey
SSDT pxfsf.sys ZwDeviceIoControlFile
SSDT pxfsf.sys ZwDuplicateObject
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwEnumerateValueKey
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwFlushKey
SSDT pxfsf.sys ZwFreeUserPhysicalPages
SSDT pxfsf.sys ZwFreeVirtualMemory
SSDT pxfsf.sys ZwImpersonateAnonymousToken
SSDT pxfsf.sys ZwImpersonateThread
SSDT pxfsf.sys ZwLoadDriver
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwLoadKey
SSDT pxfsf.sys ZwLoadKey2
SSDT pxfsf.sys ZwLockRegistryKey
SSDT pxfsf.sys ZwLockVirtualMemory
SSDT pxfsf.sys ZwMapViewOfSection
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdfsdrv.sys ZwOpenFile
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwOpenKey
SSDT pxfsf.sys ZwOpenProcess
SSDT pxfsf.sys ZwOpenProcessToken
SSDT pxfsf.sys ZwOpenSection
SSDT pxfsf.sys ZwOpenThread
SSDT pxfsf.sys ZwOpenThreadToken
SSDT pxfsf.sys ZwProtectVirtualMemory
SSDT pxfsf.sys ZwQueryInformationProcess
SSDT pxfsf.sys ZwQueryInformationThread
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryKey
SSDT pxfsf.sys ZwQueryMultipleValueKey
SSDT pxfsf.sys ZwQueryOpenSubKeys
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwQueryValueKey
SSDT pxfsf.sys ZwQueueApcThread
SSDT pxfsf.sys ZwReadFile
SSDT pxfsf.sys ZwReadVirtualMemory
SSDT pxfsf.sys ZwRenameKey
SSDT pxfsf.sys ZwReplaceKey
SSDT pxfsf.sys ZwRestoreKey
SSDT pxfsf.sys ZwResumeProcess
SSDT pxfsf.sys ZwResumeThread
SSDT pxfsf.sys ZwSaveKey
SSDT pxfsf.sys ZwSaveKeyEx
SSDT pxfsf.sys ZwSaveMergedKeys
SSDT pxfsf.sys ZwSetContextThread
SSDT pxfsf.sys ZwSetInformationKey
SSDT pxfsf.sys ZwSetInformationProcess
SSDT pxfsf.sys ZwSetInformationThread
SSDT pxfsf.sys ZwSetSystemInformation
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwSetValueKey
SSDT pxfsf.sys ZwSuspendProcess
SSDT pxfsf.sys ZwSuspendThread
SSDT pxfsf.sys ZwSystemDebugControl
SSDT pxfsf.sys ZwTerminateJobObject
SSDT pxfsf.sys ZwTerminateProcess
SSDT pxfsf.sys ZwTerminateThread
SSDT pxfsf.sys ZwUnloadDriver
SSDT \??\C:\Programmi\Softwin\BitDefender9\bdrsdrv.sys ZwUnloadKey
SSDT pxfsf.sys ZwUnloadKeyEx
SSDT pxfsf.sys ZwUnlockVirtualMemory
SSDT pxfsf.sys ZwUnmapViewOfSection
SSDT pxfsf.sys ZwWriteFile
SSDT pxfsf.sys ZwWriteVirtualMemory
---- Kernel code sections - GMER 1.0.12 ----
.text ntkrnlpa.exe!ZwCallbackReturn + 23B4 805010B8 24 Bytes [ 79, 68, 3C, F7, 83, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23D0 805010D4 16 Bytes [ 5E, 69, 52, B9, BF, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23E4 805010E8 12 Bytes [ DD, 68, 3C, F7, E7, 68, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 23F4 805010F8 24 Bytes [ FB, 68, 3C, F7, 05, 69, 3C, ... ]
.text ntkrnlpa.exe!ZwCallbackReturn + 24B0 805011B4 12 Bytes [ A5, 69, 3C, F7, 58, 6F, 52, ... ]
.text ...
? C:\WINDOWS\system32\DRIVERS\update.sys
---- User code sections - GMER 1.0.12 ----
.text C:\Programmi\File comuni\Softwin\BitDefender Scan Server\bdss.exe[468] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\explorer.exe[504] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\winlogon.exe[568] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\services.exe[612] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wbem\wmiprvse.exe[1012] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe[1048] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe[1172] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashServ.exe[1220] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Softwin\BitDefender9\bdoesrv.exe[1484] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashWebSv.exe[1580] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\nvsvc32.exe[1640] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 00613090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 00612D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 00612CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 00613020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 00612DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!send 71A3428A 5 Bytes JMP 00612AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 00612D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 00612A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 00613060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXAgent.exe[1680] WS2_32.DLL!accept 71A41028 5 Bytes JMP 00612F30 C:\WINDOWS\system32\sockspy.dll
.text C:\PROGRA~1\Softwin\BITDEF~1\bdswitch.exe[1684] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\soundman.exe[1792] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Java\jre1.6.0_01\bin\jusched.exe[1824] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Alwil Software\Avast4\ashDisp.exe[1848] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\rundll32.exe[2288] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrotray.exe[2388] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\QuickTime\qttask.exe[2412] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 003C3090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!sendto 71A32C69 5 Bytes JMP 003C2D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!recvfrom 71A32D0F 5 Bytes JMP 003C2CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!bind 71A33E00 5 Bytes JMP 003C3020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!connect 71A3406A 5 Bytes JMP 003C2DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!send 71A3428A 5 Bytes JMP 003C2AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!gethostbyname 71A34FD4 5 Bytes JMP 003C2D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!listen 71A388D3 5 Bytes JMP 003C2A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!closesocket 71A39639 5 Bytes JMP 003C3060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Prevx2\PXConsole.exe[2428] WS2_32.DLL!accept 71A41028 5 Bytes JMP 003C2F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\ctfmon.exe[2476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Adobe\Updater5\AdobeUpdater.exe[2540] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\System32\sockspy.dll
.text C:\WINDOWS\system32\alg.exe[2584] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\System32\sockspy.dll
.text C:\Programmi\Adobe\Reader 8.0\Reader\reader_sl.exe[2780] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\Adobe\Acrobat 8.0\Acrobat\acrobat_sl.exe[2980] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\File comuni\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe[3076] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!sendto 71A32C69 5 Bytes JMP 10002D10 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!recvfrom 71A32D0F 5 Bytes JMP 10002CA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!bind 71A33E00 5 Bytes JMP 10003020 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!connect 71A3406A 5 Bytes JMP 10002DA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!send 71A3428A 5 Bytes JMP 10002AA0 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!gethostbyname 71A34FD4 5 Bytes JMP 10002D70 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!listen 71A388D3 5 Bytes JMP 10002A60 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!closesocket 71A39639 5 Bytes JMP 10003060 C:\WINDOWS\system32\sockspy.dll
.text C:\WINDOWS\system32\wuauclt.exe[3108] WS2_32.dll!accept 71A41028 5 Bytes JMP 10002F30 C:\WINDOWS\system32\sockspy.dll
.text C:\Programmi\WinRAR\WinRAR.exe[3476] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
.text C:\DOCUME~1\BARTOL~1\IMPOST~1\Temp\Rar$EX00.344\gmer.exe[3504] kernel32.dll!LoadLibraryA 7C801D77 5 Bytes JMP 10003090 C:\WINDOWS\system32\sockspy.dll
---- EOF - GMER 1.0.12 ----