# pc keep freeze within a minute



## ert6ic

Hi, my issues just started yesterday, it is a desktop, operating on Windows 7 home edition, at the beginning, it just turn off by itself then turn on, now, it just freezes itself, i have tried to power off then turn it back on, it still freezes within a minute, hope this can be solved ASAP, thanks in advance, here's my HJT:


Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 2:13:03 PM, on 4/13/2013
Platform: Windows 7 SP1 (WinNT 6.00.3505)
MSIE: Internet Explorer v10.0 (10.00.9200.16537)
Boot mode: Safe mode

Running processes:
C:\Windows\Explorer.EXE
C:\Windows\system32\ctfmon.exe
C:\Program Files\DAEMON Tools Pro\DTShellHlp.exe
C:\Windows\system32\DllHost.exe
C:\Program Files\AVG Secure Search\vprot.exe
C:\Windows\system32\DXPServer.exe
F:\HijackThis.exe

R3 - URLSearchHook: (no name) - {00000000-6E41-4FD3-8538-502F5495E5FC} - (no file)
R3 - URLSearchHook: (no name) - {687578b9-7132-4a7a-80e4-30ee31099e03} - (no file)
O2 - BHO: VideoUrlSniffer - {00000ADA-7E0D-47C1-986C-F017D09C4304} - C:\Users\Public\Thunder Network\XMP4\Core\Program\VideoUrlSniffer.2.0.3.100.(382).dll (file missing)
O2 - BHO: HP Print Enhancer - {0347C33E-8762-4905-BF09-768834316C61} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_printenhancer.dll
O2 - BHO: XlBrowserAddinBho.XlBrowserAddinBhoObject - {0EA37B17-6B8B-4085-8257-F3A4AA69C27A} - C:\Program Files\Thunder Network\Thunder\BHO\XlBrowserAddin1.0.8.71.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll
O2 - BHO: Lync Click to Call BHO - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
O2 - BHO: XunleiBHO - {889D2FEB-5411-4565-8998-1DD2C5261283} - C:\Program Files\Thunder Network\Thunder\BHO\XunleiBHO7.2.12.3824.dll
O2 - BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O2 - BHO: (no name) - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - (no file)
O2 - BHO: URLRedirectionBHO - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~1\MICROS~4\Office15\URLREDIR.DLL
O2 - BHO: Microsoft SkyDrive Pro Browser Helper - {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} - C:\PROGRA~1\MICROS~4\Office15\GROOVEEX.DLL
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
O2 - BHO: Hotspot Shield Class - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - C:\Program Files\Hotspot Shield\HssIE\HssIE.dll (file missing)
O2 - BHO: HP Smart BHO Class - {FFFFFFFF-CF4E-4F2B-BDC2-0E72E116A856} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O3 - Toolbar: AVG Security Toolbar - {95B7759C-8C7F-4BF1-B163-73684A933233} - C:\Program Files\AVG Secure Search\14.2.0.1\AVG Secure Search_toolbar.dll
O4 - HKLM\..\Run: [APSDaemon] "C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [AVG_UI] "C:\Program Files\AVG\AVG2013\avgui.exe" /TRAYONLY
O4 - HKLM\..\Run: [IntelliType Pro] "C:\Program Files\Microsoft Mouse and Keyboard Center\itype.exe"
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe"
O4 - HKLM\..\Run: [vProt] "C:\Program Files\AVG Secure Search\vprot.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\RunOnce: [AvgUninstallURL] cmd.exe /c start http://www.avg.com/ww.special-uninstallation-feedback-app?lic=OE1FSC1SRk9ENC1TWFdSOC1KUlRRQS1KQURDSi1XRU1CUg"&"inst=NzYtMTIzMzkzM jE2Mi1TVDEyT0krMS1WSVAxMisxLUREVCswLUVVTEErMS1UMzBFUCsxLVAxMk1CKzEtU1BEKzEt RDM4MUwrNi1TVDEwQVBQKzEtSTEwKzEtQ0lEKzEtSUlTQSsy"&"prod=94"&"ver=10.0.1424
O4 - HKLM\..\RunOnce: [WinSATRestorePower] powercfg -setactive 381b4222-f694-41f0-9685-ff5bb260df2e
O4 - HKCU\..\Run: [Google Update] "C:\Users\KEN\AppData\Local\Google\Update\GoogleUpdate.exe" /c
O4 - HKCU\..\Run: [PPS Accelerator] C:\PPStream\ppsap.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /autoRun (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (User 'NETWORK SERVICE')
O8 - Extra context menu item: &Ê¹ÓÃ&Ñ¸À×ÀëÏßÏÂÔØ - C:\Program Files\Thunder Network\Thunder\BHO\OfflineDownload.htm
O8 - Extra context menu item: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØ - C:\Program Files\Thunder Network\Thunder\BHO\geturl.htm
O8 - Extra context menu item: &Ê¹ÓÃ&Ñ¸À×ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\Thunder Network\Thunder\BHO\GetAllUrl.htm
O8 - Extra context menu item: &Ñ¸À×ÏÂÔØµ½ÊÖ»ú - http://static.u.155.com/shoulei/shouleidl.htm
O8 - Extra context menu item: Download with &Media Finder - C:\Program Files\Media Finder\hook.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office15\EXCEL.EXE/3000
O8 - Extra context menu item: Se&nd to OneNote - res://C:\PROGRA~1\MICROS~4\Office15\ONBttnIE.dll/105
O8 - Extra context menu item: ¨Ï¥Î¨³¹p¬Ý¬Ý¼½©ñ¾¹¼½©ñ - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEMenu.htm
O8 - Extra context menu item: Ê¹ÓÃ¿ì³µ3ÏÂÔØ - C:\Program Files\FlashGet Network\FlashGet 3\fdgeturl.htm
O8 - Extra context menu item: Ê¹ÓÃ¿ì³µ3ÏÂÔØµ±Ç°ÊÓÆµ - C:\Program Files\FlashGet Network\FlashGet 3\fdgetflvurl.htm
O8 - Extra context menu item: Ê¹ÓÃ¿ì³µ3ÏÂÔØÈ«²¿ÊÓÆµ - C:\Program Files\FlashGet Network\FlashGet 3\fdgetallflvurl.htm
O8 - Extra context menu item: Ê¹ÓÃ¿ì³µ3ÏÂÔØÈ«²¿Á´½Ó - C:\Program Files\FlashGet Network\FlashGet 3\fdgetallurl.htm
O9 - Extra button: (no name) - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra 'Tools' menuitem: ??¡L31p?Y?Y??cn?1 - {14c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolMenu.htm
O9 - Extra button: ??¡L31p?Y?Y??cn?1 - {24c1d00e-0b92-4379-880b-444fa2d740dd} - C:\Users\Public\Thunder Network\XMP4\Core\Program\XmpIEToolBar.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: Se&nd to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Program Files\Microsoft Office\Office15\ONBttnIE.dll
O9 - Extra button: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra 'Tools' menuitem: Lync Click to Call - {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} - C:\Program Files\Microsoft Office\Office15\OCHelper.dll
O9 - Extra button: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra 'Tools' menuitem: OneNote Lin&ked Notes - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Program Files\Microsoft Office\Office15\ONBttnIELinkedNotes.dll
O9 - Extra button: Show or hide HP Smart Web Printing - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - C:\Program Files\HP\Digital Imaging\Smart Web Printing\hpswp_BHO.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O10 - Unknown file in Winsock LSP: c:\program files\common files\microsoft shared\windows live\wlidnsp.dll
O11 - Options group: [ACCELERATED_GRAPHICS] Accelerated graphics
O15 - ESC Trusted Zone: http://*.update.microsoft.com
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262F} (System Requirements Lab) -  http://www.nvidia.com/content/Driver...reqlab_nvd.cab
O16 - DPF: {3860DD98-0549-4D50-AA72-5D17D200EE10} (Windows Live OneCare safety scanner control) -  http://cdn.scan.onecare.live.com/res.../wlscctrl2.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
O18 - Protocol: dssrequest - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: KuGoo - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~1\KUGOU2~1\KUGOO3~1.OCX
O18 - Protocol: KuGoo3 - {6AC4FBC7-AA38-45EC-9634-D6D20B679EFC} - C:\PROGRA~1\KUGOU2~1\KUGOO3~1.OCX
O18 - Protocol: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office\Office15\MSOSB.DLL
O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - (no file)
O18 - Protocol: viprotocol - {B658800C-F66E-4EF3-AB85-6C0C227862A9} - C:\Program Files\Common Files\AVG Secure Search\ViProtocolInstaller\14.2.0\ViProtocol.dll
O18 - Filter hijack: text/xml - {807583E5-5146-11D5-A672-00B0D022E945} - C:\Program Files\Common Files\Microsoft Shared\OFFICE15\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe Acrobat Update Service (AdobeARMservice) - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
O23 - Service: Adobe Flash Player Update Service (AdobeFlashPlayerUpdateSvc) - Adobe Systems Incorporated - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
O23 - Service: AVG Firewall (avgfws) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgfws.exe
O23 - Service: AVGIDSAgent - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgidsagent.exe
O23 - Service: AVG WatchDog (avgwd) - AVG Technologies CZ, s.r.o. - C:\Program Files\AVG\AVG2013\avgwdsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Update Service (gupdatem) (gupdatem) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Hotspot Shield Service (hshld) - Unknown owner - C:\Program Files\Hotspot Shield\bin\openvpnas.exe (file missing)
O23 - Service: Hotspot Shield Tray Service (HssTrayService) - Unknown owner - C:\Program Files\Hotspot Shield\bin\HssTrayService.EXE (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: KMService - Unknown owner - C:\Windows\system32\srvany.exe
O23 - Service: ?iOAEe¡Ó¡M¡PtIn (KYDeviceServer) - ¥_¨Ê±yµM¤Ñ¦a¬ì§Þ¦³**¤½¥q - C:\Program Files\kuaiyong\DRM\KYDeviceServer.exe
O23 - Service: MBAMScheduler - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamscheduler.exe
O23 - Service: MBAMService - Malwarebytes Corporation - C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe
O23 - Service: Mozilla Maintenance Service (MozillaMaintenance) - Mozilla Foundation - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe
O23 - Service: NVIDIA Update Service Daemon (nvUpdatusService) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
O23 - Service: NVIDIA Stereoscopic 3D Driver Service (Stereo Service) - NVIDIA Corporation - C:\Program Files\NVIDIA Corporation\3D  Vision\nvSCPAPISvr.exe
O23 - Service: AVG PC TuneUp Service (TuneUp.UtilitiesSvc) - AVG - C:\Program Files\AVG\AVG PC TuneUp\TuneUpUtilitiesService32.exe
O23 - Service: vToolbarUpdater14.2.0 - Unknown owner - C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\14.2.0\ToolbarUpdater.exe

--
End of file - 12069 bytes


----------



## ert6ic

GMER 2.1.19163 - GMER - Rootkit Detector and Remover
Rootkit scan 2013-04-14 15:51:12
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-6 WDC_WD2500AAJS-00B4A0 rev.01.03A01 232.89GB
Running: gmer.exe; Driver: C:\Users\KEN\AppData\Local\Temp\uwldypow.sys


---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeKey [0x949E114A]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwNotifyChangeMultipleKeys [0x949E121A]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwOpenProcess [0x949E0D7C]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendProcess [0x949E0F6A]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwSuspendThread [0x949E1000]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateProcess [0x949E0E32]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwTerminateThread [0x949E0ECE]
SSDT \SystemRoot\system32\DRIVERS\avgidsshimx.sys ZwWriteVirtualMemory [0x949E109C]

---- Kernel code sections - GMER 2.1 ----

.text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 8305BA09 1 Byte [06]
.text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 830951F2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text ntkrnlpa.exe!KeRemoveQueueEx + 1357 8309C4AC 8 Bytes [4A, 11, 9E, 94, 1A, 12, 9E, ...] {DEC EDX; ADC [ESI-0x61ede56c], EBX; XCHG ESP, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 139F 8309C4F4 4 Bytes [7C, 0D, 9E, 94] {JL 0xf; SAHF ; XCHG ESP, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 165F 8309C7B4 8 Bytes [6A, 0F, 9E, 94, 00, 10, 9E, ...] {PUSH 0xf; SAHF ; XCHG ESP, EAX; ADD [EAX], DL; SAHF ; XCHG ESP, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 166F 8309C7C4 8 Bytes [32, 0E, 9E, 94, CE, 0E, 9E, ...] {XOR CL, [ESI]; SAHF ; XCHG ESP, EAX; INTO ; PUSH CS; SAHF ; XCHG ESP, EAX}
.text ntkrnlpa.exe!KeRemoveQueueEx + 16E3 8309C838 4 Bytes [9C, 10, 9E, 94]
.sptd1 C:\Windows\System32\Drivers\sptd.sys  entry point in ".sptd1" section [0x8C3A3B2E]
? C:\Windows\System32\Drivers\afahdjuh.SYS suspicious PE modification

---- User code sections - GMER 2.1 ----

.text C:\Windows\system32\svchost.exe[3104] kernel32.dll!GetModuleFileNameA 7524D75A 5 Bytes JMP 257E63D0 c:\program files\common files\thunder network\serviceplatform\xlsp.dll
.text C:\Windows\system32\svchost.exe[3104] kernel32.dll!GetModuleFileNameW 7524EF35 5 Bytes JMP 257E63A0 c:\program files\common files\thunder network\serviceplatform\xlsp.dll
.text C:\Windows\system32\svchost.exe[3104] kernel32.dll!UnhandledExceptionFilter 75260651 7 Bytes JMP 21871339 c:\program files\common files\thunder network\serviceplatform\XLBugHandler.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!GetQueuedCompletionStatus 75234E90 5 Bytes JMP 2F035CC8 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!CreateIoCompletionPort 75238ED1 5 Bytes JMP 2F035C74 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!SetFilePointerEx 7523FBB2 5 Bytes JMP 2F035A90 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!GetFileSize 7524086B 5 Bytes JMP 2F035B93 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!GetOverlappedResult 75243671 5 Bytes JMP 2F035C21 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!GetFileSizeEx 752499F9 5 Bytes JMP 2F035BDA C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!ReadFile 75249BAE 7 Bytes JMP 2F035886 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!CloseHandle 7524E868 5 Bytes JMP 2F035B41 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!CreateFileW 7524E8A5 5 Bytes JMP 2F03567E C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!CreateFileA 7524EA61 5 Bytes JMP 2F035618 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!SetFilePointer 7525060D 5 Bytes JMP 2F035A36 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!WriteFile 752553EE 5 Bytes JMP 2F035937 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!OpenFile 7525D54F 5 Bytes JMP 2F0359E8 C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!ReadFileEx 75265515 5 Bytes JMP 2F0358DE C:\PPStream\Vodres.dll
.text C:\PPStream\PPSAP.exe[3516] kernel32.dll!WriteFileEx 7526552D 5 Bytes JMP 2F03598F C:\PPStream\Vodres.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4132] ntdll.dll!LdrGetProcedureAddress + 26 77162239 7 Bytes JMP 65396D70 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4132] kernel32.dll!K32GetDeviceDriverBaseNameW + 5D 7524941E 7 Bytes JMP 656ED713 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4132] kernel32.dll!QueryPerformanceCounter + 13 7524C435 7 Bytes JMP 656ED736 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4132] kernel32.dll!LoadAppInitDlls + 355 7524F4F6 7 Bytes JMP 653B1C62 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[4132] GDI32.dll!GetViewportOrgEx + 26C 767F884B 7 Bytes JMP 656ED694 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\kuaiyong\DRM\KYDeviceServer.exe[5116] ntdll.dll!LdrLoadDll 7716223E 5 Bytes JMP 10036F90 C:\Program Files\kuaiyong\DRM\DevResManager.dll
.text C:\Program Files\kuaiyong\DRM\KYDeviceServer.exe[5116] ADVAPI32.dll!RegOpenKeyExA 77274907 5 Bytes JMP 10037070 C:\Program Files\kuaiyong\DRM\DevResManager.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5616] USER32.dll!RegisterMessagePumpHook + 2F1 75138B9E 7 Bytes JMP 659243E6 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5616] USER32.dll!IsDialogMessageW + 340 75144444 7 Bytes JMP 65924375 C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5616] USER32.dll!GetWindowInfo 75144B5E 5 Bytes JMP 6556E50D C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Program Files\Mozilla Firefox\plugin-container.exe[5616] USER32.dll!ToUnicodeEx + 71 75152223 7 Bytes JMP 6556E9FB C:\Program Files\Mozilla Firefox\xul.dll
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateFile + 6 771455CE 4 Bytes [28, 38, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateFile + B 771455D3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateKey + 6 7714560E 4 Bytes [68, 39, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateKey + B 77145613 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateMutant + 6 7714564E 4 Bytes [68, 3A, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateMutant + B 77145653 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateSection + 6 771456EE 4 Bytes [A8, 3A, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtCreateSection + B 771456F3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtMapViewOfSection + B 77145C33 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenFile + 6 77145CDE 4 Bytes [68, 38, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenFile + B 77145CE3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenKey + 6 77145D0E 4 Bytes [A8, 39, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenKey + B 77145D13 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenKeyEx + B 77145D23 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenMutant + 6 77145D5E 4 Bytes [28, 3A, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenMutant + B 77145D63 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcess + 6 77145D8E 4 Bytes [68, 3B, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcess + B 77145D93 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcessToken + 6 77145D9E 4 Bytes [A8, 3B, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcessToken + B 77145DA3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcessTokenEx + 6 77145DAE 4 Bytes [68, 3C, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenProcessTokenEx + B 77145DB3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenSection + B 77145DD3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThread + 6 77145E0E 4 Bytes [28, 3B, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThread + B 77145E13 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThreadToken + 6 77145E1E 4 Bytes [28, 3C, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThreadToken + B 77145E23 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThreadTokenEx + 6 77145E2E 4 Bytes [A8, 3C, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtOpenThreadTokenEx + B 77145E33 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtQueryAttributesFile + 6 77145F3E 4 Bytes [A8, 38, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtQueryAttributesFile + B 77145F43 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtQueryFullAttributesFile + B 77145FF3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtSetInformationFile + 6 7714663E 4 Bytes [28, 39, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtSetInformationFile + B 77146643 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtSetInformationThread + B 771466A3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtUnmapViewOfSection + 6 771469BE 4 Bytes [28, 3D, 07, 00]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ntdll.dll!NtUnmapViewOfSection + B 771469C3 1 Byte [E2]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] kernel32.dll!CreateProcessW 7520204D 5 Bytes JMP 00080030 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] kernel32.dll!CreateProcessA 75202082 5 Bytes JMP 00080070 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!ActivateKeyboardLayout 75138203 5 Bytes JMP 002304F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!ScreenToClient 7513A506 7 Bytes JMP 00230670 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!RegisterClipboardFormatA 7513C091 5 Bytes JMP 002302F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!RegisterClipboardFormatW 7513DF8D 5 Bytes JMP 002302B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!SetCursor 75143075 5 Bytes JMP 00230530 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!MonitorFromWindow 75143622 7 Bytes JMP 00230630 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!PostMessageW 7514447B 5 Bytes JMP 002305F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!IsWindowVisible 75144D69 7 Bytes JMP 002306B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClientRect 751454DD 7 Bytes JMP 002305B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!MapWindowPoints 75145CAA 5 Bytes JMP 00230570 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetParent 75146029 7 Bytes JMP 002306F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!EmptyClipboard 7515290C 5 Bytes JMP 00230130 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!SetClipboardData 75152962 5 Bytes JMP 00230170 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardData 75152BA7 5 Bytes JMP 00230030 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardFormatNameW 75155FD2 5 Bytes JMP 00230230 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!SetClipboardViewer 75156FF6 5 Bytes JMP 002304B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardFormatNameA 7515700A 5 Bytes JMP 00230270 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!ChangeClipboardChain 7516147C 5 Bytes JMP 00230430 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetTopWindow 751624D9 7 Bytes JMP 00230730 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!CloseClipboard 7516446C 5 Bytes JMP 002300B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!OpenClipboard 7516447E 5 Bytes JMP 00230070 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!IsClipboardFormatAvailable 751644FF 5 Bytes JMP 002300F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardSequenceNumber 75164513 5 Bytes JMP 00230330 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardOwner 75164525 5 Bytes JMP 00230370 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!CountClipboardFormats 7516470A 5 Bytes JMP 002301F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!EnumClipboardFormats 751647EC 5 Bytes JMP 002301B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetOpenClipboardWindow 7516480B 5 Bytes JMP 002303F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!SetCursorPos 7517C1B0 5 Bytes JMP 00230770 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetClipboardViewer 75194AF7 5 Bytes JMP 00230470 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] user32.DLL!GetPriorityClipboardFormat 75194BF9 5 Bytes JMP 002303B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!DeleteObject 767F5F14 5 Bytes JMP 002401B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SelectObject 767F6640 5 Bytes JMP 002405F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetTextColor 767F6906 5 Bytes JMP 00240A30 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetBkMode 767F69B1 5 Bytes JMP 002408F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!DeleteDC 767F6EAA 5 Bytes JMP 00240170 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetDeviceCaps 767F6F7F 5 Bytes JMP 002403B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!ExtSelectClipRgn 767F7114 5 Bytes JMP 002402F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SelectClipRgn 767F7242 5 Bytes JMP 002405B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetStretchBltMode 767F7705 5 Bytes JMP 002406B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetCurrentObject 767F7917 5 Bytes JMP 00240370 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextMetricsW 767F7B8F 5 Bytes JMP 00240E30 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextAlign 767F7DAF 5 Bytes JMP 00240D70 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!IntersectClipRect 767F7DFE 5 Bytes JMP 002403F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!ExtTextOutW 767F8192 5 Bytes JMP 00240970 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetTextAlign  767F828E 5 Bytes JMP 002409F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetClipBox 767F8525 5 Bytes JMP 00240330 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!MoveToEx 767F8C21 5 Bytes JMP 00240470 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!StretchDIBits 767FA53E 5 Bytes JMP 00240770 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!RestoreDC 767FA67B 5 Bytes JMP 00240530 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SaveDC 767FA74B 5 Bytes JMP 00240570 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextExtentPoint32W 767FB4B5 5 Bytes JMP 00240670 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextFaceW 767FB73A 2 Bytes JMP 00240D30 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextFaceW + 3 767FB73D 2 Bytes [A4, 89]
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetFontData 767FBCC4 5 Bytes JMP 00240C70 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetWorldTransform 767FC90A 5 Bytes JMP 002406F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!CreateDCA 767FCCA9 5 Bytes JMP 002400B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!CreateDCW 767FCF79 5 Bytes JMP 002400F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!CreateICW 767FCFD0 5 Bytes JMP 00240130 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextMetricsA 767FD0F2 5 Bytes JMP 00240DF0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!Rectangle 767FF1FF 5 Bytes JMP 002409B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!LineTo 767FF59B 5 Bytes JMP 00240430 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetICMMode 767FFAA4 5 Bytes JMP 00240DB0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!ExtTextOutA 768003F9 5 Bytes JMP 00240930 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextExtentPoint32A 768007B0 5 Bytes JMP 00240630 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!ExtEscape 76802949 5 Bytes JMP 002402B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!Escape 76803939 5 Bytes JMP 00240270 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetTextFaceA 76803E6A 5 Bytes JMP 00240CF0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetPolyFillMode 7680D851 5 Bytes JMP 00240B30 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SetMiterLimit  7680DA0D 5 Bytes JMP 00240B70 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!EndPage 768100D7 5 Bytes JMP 00240230 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!ResetDCW 7681050D 5 Bytes JMP 00240AB0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!GetGlyphOutlineW 7681C1BA 5 Bytes JMP 00240CB0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!CreateScalableFontResourceW 7681E817 5 Bytes JMP 00240BB0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!AddFontResourceW 7681EC13 5 Bytes JMP 00240BF0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!RemoveFontResourceW 7681F109 5 Bytes JMP 00240C30 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!AbortDoc 76824C63 5 Bytes JMP 00240030 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!EndDoc 768250AA 5 Bytes JMP 002401F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!StartPage 76825195 5 Bytes JMP 00240730 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!StartDocW 76825BB0 5 Bytes JMP 002407F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!BeginPath 7682635D 5 Bytes JMP 00240830 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!SelectClipPath 768263B4 5 Bytes JMP 00240AF0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!CloseFigure 7682640F 5 Bytes JMP 00240070 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!EndPath 76826466 5 Bytes JMP 00240A70 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!StrokePath 76826699 5 Bytes JMP 002407B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!FillPath 76826726 5 Bytes JMP 00240870 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!PolylineTo 76826B94 5 Bytes JMP 002404F0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!PolyBezierTo 76826C25 5 Bytes JMP 002404B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] GDI32.dll!PolyDraw 76826CD7 5 Bytes JMP 002408B0 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ole32.dll!OleSetClipboard 76550045 5 Bytes JMP 00260030 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ole32.dll!OleIsCurrentClipboard 765536B2 5 Bytes JMP 00260070 
.text C:\Windows\system32\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe[5788] ole32.dll!OleGetClipboard 7657FDCD 5 Bytes JMP 002600B0 

---- Devices - GMER 2.1 ----

Device \FileSystem\Ntfs \Ntfs 85C161E8
Device \Driver\usbuhci \Device\USBPDO-0  87127430
Device \Driver\usbuhci \Device\USBPDO-1 87127430
Device \Driver\usbuhci \Device\USBPDO-2 87127430
Device \Driver\usbuhci \Device\USBPDO-3 87127430
Device \Driver\usbehci \Device\USBPDO-4 870831E8

AttachedDevice \Driver\tdx \Device\Tcp avgtdix.sys

Device \Driver\cdrom \Device\CdRom0 86D9C430
Device \Driver\atapi \Device\Ide\IdePort0 85C141E8
Device \Driver\atapi \Device\Ide\IdePort1 85C141E8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-6 85C141E8
Device \Driver\atapi \Device\Ide\IdePort2 85C141E8
Device \Driver\atapi \Device\Ide\IdePort3 85C141E8
Device \Driver\atapi \Device\Ide\IdePort4 85C141E8
Device \Driver\atapi \Device\Ide\IdePort5 85C141E8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-8 85C141E8
Device \Driver\atapi \Device\Ide\IdeDeviceP3T0L0-7 85C141E8
Device \Driver\atapi \Device\Ide\IdeDeviceP4T0L0-c 85C141E8
Device \Driver\cdrom \Device\CdRom1 86D9C430
Device \Driver\cdrom \Device\CdRom2 86D9C430
Device \Driver\cdrom \Device\CdRom3 86D9C430
Device \Driver\PCI_PNP7461 \Device\00000075 sptd.sys
Device \Driver\PCI_PNP7461 \Device\00000075 sptd.sys
Device \Driver\cdrom \Device\CdRom4 86D9C430
Device \Driver\dtsoftbus01 \Device\DTSoftBusCtl 86EB51E8
Device \Driver\NetBT \Device\NetBt_Wins_Export 86FDF1E8

AttachedDevice \Driver\tdx \Device\Udp avgtdix.sys
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys

Device \Driver\usbuhci \Device\USBFDO-0 87127430
Device  \Driver\usbuhci \Device\USBFDO-1 87127430
Device \Driver\usbuhci \Device\USBFDO-2 87127430
Device \Driver\NetBT \Device\NetBT_Tcpip_{B9CF9848-0464-4218-90D7-62F9829A3040} 86FDF1E8
Device \Driver\usbuhci \Device\USBFDO-3 87127430
Device \Driver\usbehci \Device\USBFDO-4 870831E8
Device \Driver\dtsoftbus01 \Device\0000008b 86EB51E8
Device \Driver\dtsoftbus01 \Device\0000008c 86EB51E8
Device \Driver\afahdjuh \Device\Scsi\afahdjuh1Port6Path0Target0Lun0 86DCF1E8
Device \Driver\afahdjuh \Device\Scsi\afahdjuh1 86DCF1E8
Device \FileSystem\cdfs \Cdfs 877531E8

---- Trace I/O - GMER 2.1 ----

Trace ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll >>UNKNOWN [0x85c141e8]<< 85c141e8
Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86a9f460] 86a9f460
Trace 3 CLASSPNP.SYS[8c9ac59e] -> nt!IofCallDriver -> [0x85c4a848] 85c4a848
Trace 5 ACPI.sys[837a03d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-6[0x85bdc030] 85bdc030
Trace \Driver\atapi[0x8694bf38] -> IRP_MJ_CREATE -> 0x85c141e8 85c141e8

---- Threads - GMER 2.1 ----

Thread System [4:1572] A61A2F2E

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\[email protected] 21354
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC 
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\[email protected] C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\[email protected] 0x45 0xEF 0x42 0xA9 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x93 0x4A 0xF1 0x9B ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0xD8 0x64 0xF8 0xC4 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002 
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x10 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x7C 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0xB7 0x1D 0xDA 0x77 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0 
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\[email protected] 0xD8 0x64 0xF8 0xC4 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\[email protected] C:\Program Files\DAEMON Tools Pro\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\[email protected] 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\[email protected] 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\[email protected] 0x45 0xEF 0x42 0xA9 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0xA0 0x02 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x93 0x4A 0xF1 0x9B ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\[email protected] 0xD8 0x64 0xF8 0xC4 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x10 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0x7C 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\[email protected] 0xB7 0x1D 0xDA 0x77 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\gdq0 (not active ControlSet) 
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000002\[email protected] 0xD8 0x64 0xF8 0xC4 ...
Reg HKLM\SOFTWARE\Microsoft\Windows\Windows Error Reporting\[email protected] C:\Users\KEN\AppData\Local\Microsoft\Windows\WER\ReportArchive\Kernel_0_0_cab_0a44a9d9

---- Files - GMER 2.1 ----

File C:\Users\KEN\AppData\Local\Temp\acro_rd_dir\fla2D1E.tmp 2534586 bytes

---- EOF - GMER 2.1 ----


----------



## ert6ic

Hi, need some help here please. Now can't even use my desktop at all, as soon I power on the pc after screen freeze, there is a Java update notice icon then it freezes again, on and on, tried run security software in safe mood, it wouldn't let me, hope some experts can help me out here, thanks in advance.


----------

