I need help with my files, please. For some reason Gmer is the only one that detects intrusion, everything else (including detection program) is passing by unharmed unless it is linked to a ''pup''. Running a copy legit of windows 8, I download a bit here and there but I'm not a heavy surfer. I don't want to reformat, are there any solutions? I tried even Trojan remover and unhack me nothing works to remove the problems (which I guess are rootkits, worms and trojans) Thanks in advance GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-28 10:54:38 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000039 WDC_WD7500BPVX-22JC3T0 rev.01.01A01 698.64GB Running: gmer.exe; Driver: C:\Temp\uxtiqpog.sys ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [596:624] fffff960008ad5e8 Thread C:\Windows\system32\svchost.exe [900:3860] 000007fde01410f0 Thread C:\Windows\system32\svchost.exe [900:5388] 000007fde4555c38 Thread C:\Windows\System32\spoolsv.exe [1536:4736] 000007fde66e54c0 Thread C:\Windows\System32\spoolsv.exe [1536:4740] 000007fde66c30ec Thread C:\Windows\System32\spoolsv.exe [1536:4768] 000007fdde2b5798 Thread C:\Windows\System32\spoolsv.exe [1536:4776] 000007fdde2fd29c Thread C:\Windows\system32\svchost.exe [2728:2832] 000007fde66e54c0 Thread C:\Windows\system32\svchost.exe [2728:472] 000007fde66c30ec ---- EOF - GMER 2.1 ---- GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-29 08:29:39 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000038 WDC_WD7500BPVX-22JC3T0 rev.01.01A01 698.64GB Running: healer.exe; Driver: C:\Temp\uxtiqpog.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000132b00 1 byte [00] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 2 fffff96000132b02 5 bytes [7E, 01, 00, 58, F2] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\atiesrxx.exe[496] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\atiesrxx.exe[496] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\atieclxx.exe[1164] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\atieclxx.exe[1164] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-29 08:44:28 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000038 WDC_WD7500BPVX-22JC3T0 rev.01.01A01 698,64GB Running: healer.exe; Driver: C:\Temp\uxtiqpog.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000132b00 1 byte [00] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 2 fffff96000132b02 5 bytes [7E, 01, 00, 58, F2] ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\atiesrxx.exe[496] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\atiesrxx.exe[496] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\dwm.exe[844] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\atieclxx.exe[1164] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\atieclxx.exe[1164] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE[1076] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE[1076] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\wbem\wmiprvse.exe[4012] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\System32\svchost.exe[4260] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\svchost.exe[4448] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\wbem\unsecapp.exe[4612] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\SearchIndexer.exe[5832] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskhostex.exe[4172] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrl.exe[4344] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDTouch.exe[5932] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\Explorer.EXE[5944] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\Explorer.EXE[5944] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\msimg32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\msimg32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\Explorer.EXE[5944] C:\Windows\SYSTEM32\msimg32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Elantech\ETDCtrlHelper.exe[5144] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\SysWOW64\trmhost.exe[4904] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\msimg32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\msimg32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files (x86)\IObit\Start Menu 8\InstallServices.exe[3724] C:\Windows\SYSTEM32\msimg32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe[1376] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE[2332] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f8c20e177a 4 bytes [0E, C2, F8, 07] .text C:\Program Files\Acer\Acer Power Management\ePowerSvc.exe[6336] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f8c20e1782 4 bytes [0E, C2, F8, 07] .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\wbem\unsecapp.exe[6456] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Program Files\Acer\Acer Power Management\ePowerEvent.exe[6516] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\System32\RuntimeBroker.exe[1616] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskhost.exe[11996] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000007f8c42f2de0 5 bytes JMP 000007f9b69c1d00 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000007f8c42f2f00 5 bytes JMP 000007f9b69c1810 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateEvent 000007f8c42f2fe0 5 bytes JMP 000007f9b69c2090 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateMutant 000007f8c42f35c1 5 bytes JMP 000007f9b69c20f0 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\ntdll.dll!NtCreateSemaphore 000007f8c42f3651 5 bytes JMP 000007f9b69c2150 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\system32\KERNELBASE.dll!ResumeThread 000007f8c1566560 5 bytes JMP 000007f9b69c1f50 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\system32\KERNELBASE.dll!CreateProcessInternalW 000007f8c156b970 5 bytes JMP 000007f9b69c19c0 .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8bcff1532 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8bcff153a 4 bytes [FF, BC, F8, 07] .text C:\Windows\system32\taskeng.exe[13728] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8bcff165a 4 bytes [FF, BC, F8, 07] ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [648:672] fffff9600099e5e8 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----