cap2hccap — it's malware...

[epixoip]

so that you know, all that your debugger was telling you was that umengx86.dll was loaded by the current process, along with a few other shared libraries. there was nothing to indicate that anything was being modified.

umengx86.dll is part of Norton's heuristic scanning engine, so as d3ad0ne stated, your av should be injecting this dll into every running process.

and always remember to use the source: http://sourceforge.net/p/cap2hccap/svn/HEAD/tree/trunk/