Jump to content

Lin0

Members
  • Posts

    1
  • Joined

  • Last visited

Everything posted by Lin0

  1. Hi forum. Wondering if anyone has an idea of whats hiding inside my system...? Malwarebytes' Anti-Malware 1.45 www.malwarebytes.org Database version: 3955 Windows 5.1.2600 Service Pack 2 Internet Explorer 8.0.6001.18702 04/05/2010 6:41:29 AM mbam-log-2010-04-05 (06-41-29).txt Scan type: Full scan (C:\|D:\|) Objects scanned: 371636 Time elapsed: 1 hour(s), 20 minute(s), 17 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) 00:37:17 Will MESSAGE Protection started successfully 00:37:23 Will MESSAGE IP Protection started successfully 00:46:33 Will IP-BLOCK 210.51.180.239 02:06:23 Will MESSAGE Protection started successfully 02:06:27 Will MESSAGE IP Protection started successfully 02:20:30 Will MESSAGE Protection started successfully 02:20:35 Will MESSAGE IP Protection started successfully 02:29:43 Will IP-BLOCK 210.51.180.239 19:54:22 Will MESSAGE Protection started successfully 19:54:26 Will MESSAGE IP Protection started successfully 20:03:31 Will IP-BLOCK 210.51.180.239 20:30:02 Will MESSAGE Protection started successfully 20:30:07 Will MESSAGE IP Protection started successfully 21:06:49 Will MESSAGE Protection started successfully 21:06:54 Will MESSAGE IP Protection started successfully DDS (Ver_10-03-17.01) - NTFSx86 Run by Will at 20:33:01.00 on 04/07/2010 Internet Explorer: 8.0.6001.18702 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.997 [GMT -4:00] ============== Running Processes =============== C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\Program Files\UPHClean\uphclean.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe C:\Program Files\SpeedFan\speedfan.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Documents and Settings\Will\Local Settings\Temporary Internet Files\Content.IE5\30VNFOCO\dds[1].scr ============== Pseudo HJT Report =============== uStart Page = https://ssl.scroogle.org/ uWindow Title = JWC Sales & Services mWindow Title = JWC Sales & Services uSearchAssistant = hxxp://www.google.com/ie BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {5538FB62-F725-4433-A965-91314E8D8E4D} - No File TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray StartupFolder: c:\docume~1\will\startm~1\programs\startup\speedfan.lnk - c:\program files\speedfan\speedfan.exe uPolicies-explorer: NoWinKeys = 01000000 uPolicies-explorer: NoRecentDocsNetHood = 01000000 uPolicies-explorer: NoFileAssociate = 0 (0x0) mPolicies-explorer: NoFileAssociate = 0 (0x0) IE: Download Video on This Page - c:\program files\tomato\tubedownload\TDIEPage.html IE: Download Video This Links To - c:\program files\tomato\tubedownload\TDIELink.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000 IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe IE: {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - c:\program files\tomato\tubedownload\TDIEPage.html IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - d:\program files\aim95\aim.exe IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL Trusted Zone: excite.com\www Trusted Zone: microsoft.com\*.update Trusted Zone: taxsoftware.com Trusted Zone: turbotax.com Trusted Zone: windowsupdate.com\download DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204 DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - hxxp://pcpitstop.com/internet/pcpConnCheck.cab DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265101243312 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265101224578 DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - hxxp://ksunlivecam.sonoma.edu/activex/AMC.cab DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab DPF: {7DFDB8FD-B498-4958-B930-38021B94351D} - hxxp://imlive.com/chatsource/ImlCID.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://128.171.104.32/activex/AxisCamControl.cab DPF: {924C1588-90C3-4910-B6CA-D57A1C0418FE} - hxxp://bookmarks.yahoo.com/YbConvFav.CAB DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL LSA: Authentication Packages = msv1_0 relog_ap Hosts: 127.0.0.1 www.spywareinfo.com ============= SERVICES / DRIVERS =============== R0 uGuru;uGuru;c:\windows\system32\drivers\uGuru.SYS [2010-2-6 10752] R2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\lsoft technologies inc\active@ hard disk monitor\DiskMonitorService.exe [2009-12-19 1127944] R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-31 303952] R2 NetProbe;NetProbe Packet Driver;c:\windows\system32\drivers\NetProbe.sys [2009-3-24 5365] R3 GETND5BV;VIA Networking Velocity-Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5bv.sys [2005-2-14 46080] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-31 20824] S0 ULiAGP;ULi AGP Controller Bus Filter Driver;c:\windows\system32\drivers\uliagp.sys --> c:\windows\system32\drivers\ULiAGP.sys [?] S1 ai2cnt;ai2cnt;c:\windows\system32\drivers\ai2cnt.sys [2005-10-10 8247] S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasdifsv.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASDIFSV.SYS [?] S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\saskutil.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASKUTIL.sys [?] S2 gupdate1c9b0e9d753fd80;Google Update Service (gupdate1c9b0e9d753fd80);"c:\program files\google\update\googleupdate.exe" /svc --> c:\program files\google\update\GoogleUpdate.exe [?] S3 cpuz130;cpuz130;\??\c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys --> c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys [?] S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;c:\windows\system32\drivers\usbintel.sys [2002-8-28 15872] S3 HPUATA;HP CD Writer Plus Controller Driver;c:\windows\system32\drivers\HPUATA.sys [2001-9-24 75776] S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys --> c:\windows\system32\drivers\motccgp.sys [?] S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-1-6 7680] S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys --> c:\windows\system32\drivers\motodrv.sys [?] S3 SASENUM;SASENUM;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasenum.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASENUM.SYS [?] S3 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008] S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s --> c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s [?] S4 Kha78xela;Kha78xela; [x] S4 ThreadMaster;Thread Master;c:\windows\system32\threadmaster\ThreadMast.exe [2008-2-11 57344] S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?] =============== Created Last 30 ================ 2010-04-08 00:16:22 0 ----a-w- c:\documents and settings\will\defogger_reenable 2010-04-07 06:45:13 0 d-----w- c:\program files\UPHClean 2010-04-07 05:08:42 0 d-----w- c:\program files\SUPERAntiSpyware 2010-04-06 03:24:52 221184 ----a-w- c:\windows\system32\wmpns.dll 2010-04-06 02:38:11 0 d-----w- c:\windows\network diagnostic 2010-04-06 02:38:10 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys 2010-04-06 02:38:09 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys 2010-04-06 02:36:57 19569 ----a-w- c:\windows\003747_.tmp 2010-04-06 02:29:34 29704 ----a-w- c:\windows\system32\uxtuneup.dll 2010-04-02 05:48:59 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll 2010-04-02 05:48:32 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe 2010-04-02 05:45:55 16736 ----a-w- c:\windows\system32\mucltui.dll.mui 2010-04-02 05:45:54 274288 ----a-w- c:\windows\system32\mucltui.dll 2010-03-29 05:48:32 54156 ---ha-w- c:\windows\QTFont.qfn 2010-03-29 05:48:32 1409 ----a-w- c:\windows\QTFont.for 2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys2.bmp 2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys1.bmp 2010-03-29 02:44:25 0 d-----w- c:\program files\AMB Software 2010-03-17 23:53:16 0 d-----w- c:\program files\Network Probe 3 2010-03-10 01:46:17 0 d-----w- C:\Win7 ==================== Find3M ==================== 2010-03-30 04:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys 2010-03-30 04:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys 2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll 2010-02-19 00:09:42 411368 ----a-w- c:\windows\system32\deploytk.dll 2010-02-02 08:06:55 106496 ----a-w- C:\SUPER_PI.EXE ============= FINISH: 20:35:05.17 =============== GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-04-07 21:22:36 Windows 5.1.2600 Service Pack 3 Running: hlqb16fh[1].exe; Driver: C:\DOCUME~1\Will\LOCALS~1\Temp\fgtdqpow.sys ---- System - GMER 1.0.15 ---- SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0xB2D006D0] ---- Kernel code sections - GMER 1.0.15 ---- ? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys The system cannot find the file specified. ! ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D0299A .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D0294A .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D0290E .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D028F2 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D0277E .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D02870 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D027B6 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D027EE .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D7299A .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D7294A .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D7290E .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D728F2 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D7277E .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D72870 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D727B6 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D727EE .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00F5299A .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00F5294A .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00F5290E .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F528F2 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F5277E .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00F52870 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F527B6 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00F527EE .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 0106299A .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 0106294A .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 0106290E .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01062EA3 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01062EFD .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01062BF0 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 010629B6 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 010637FE .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01062D5C .text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 010633D8 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 010633E1 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 01BB299A .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 01BB294A .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 01BB290E .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01BB2EA3 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01BB2EFD .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01BB2BF0 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 01BB29B6 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 01BB37FE .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01BB2D5C .text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 01BB33D8 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 01BB33E1 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D5299A .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D5294A .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D5290E .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D528F2 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D5277E .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D52870 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D527B6 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D527EE ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Internet Explorer\iexplore.exe[3144] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis) AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis) Device \Driver\viamraid \Device\Scsi\viamraid1 8A1EEF30 Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target0Lun0 8A1EEF30 Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target2Lun0 8A1EEF30 AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158307d501 Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00158307d501 (not active ControlSet) Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE03.00.00.01MSWINDOWS C8692185F632DB87872C0E13F74D61CD21612668D214CCF6D929C7276895591C97CBAE6F6DF357A0 A9E26AEFBA7AEF6E215AE8C6297EF87C34B818328218D529363E0591FCFEBC9E127BECC74CFEBC9E 1 27BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4 9 80AC79339DB7CE019D40AA5CA2D97226D213B555A9C6AECB7A5D14076E034E8CE8E404E0855E54C4 C A034698EF5425D5BCAA080A55EF83C34D632455B493CAA2EE559FF513D0BE0916F5A6B98567BE99A 2 425ED5803F379A9E0D860180FD6D994D50E5267AA99623019F921EA55A4109CE227981887C8C3A87 9 84605E726B0A780798EECEEF3DAB9391F54813D8150DBBE7ED9A939676A0BEDF23A00B1D16105FD1 8 E287D21FDBF7DC334D63F094E14C5B3193AE91A08F7A2B30CC535B2C9EF02B96C3F8C37EBF8B013F 7 18715B0C11B88B6D036442C09F78F05FC2295C1DE2CE383A4060CC901A82DCAC9F3B5568C0C9931C E 25BAF53D795CCB5CD643086BFCF7928CBAAE1DEB05DD8371F411E938E6D763DEA98FC9E1F6C50210 9 E00D25FABA81A96E36076A4DA03B7191898338876013765B411D903EC77C9D4EA95DDAC092F16F01 4 8B399EE9815D84B1745E1B8BC53ADDF744BA005C0FE876EF06C696E233A3E1224D2EA473AF890D59 7 E7DDC78CA1C53EDE0E50FC91E49D8A70510389057863D27777FD ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 sector 01: copy of MBR Disk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 03: copy of MBR Disk \Device\Harddisk0\DR0 sector 04: copy of MBR Disk \Device\Harddisk0\DR0 sector 05: copy of MBR Disk \Device\Harddisk0\DR0 sector 06: copy of MBR Disk \Device\Harddisk0\DR0 sector 07: copy of MBR Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior; copy of MBR Disk \Device\Harddisk0\DR0 sector 09: copy of MBR Disk \Device\Harddisk0\DR0 sector 10: copy of MBR Disk \Device\Harddisk0\DR0 sector 11: copy of MBR Disk \Device\Harddisk0\DR0 sector 12: copy of MBR Disk \Device\Harddisk0\DR0 sector 13: copy of MBR Disk \Device\Harddisk0\DR0 sector 14: copy of MBR Disk \Device\Harddisk0\DR0 sector 15: copy of MBR Disk \Device\Harddisk0\DR0 sector 16: copy of MBR Disk \Device\Harddisk0\DR0 sector 17: copy of MBR Disk \Device\Harddisk0\DR0 sector 18: copy of MBR Disk \Device\Harddisk0\DR0 sector 19: copy of MBR Disk \Device\Harddisk0\DR0 sector 20: copy of MBR Disk \Device\Harddisk0\DR0 sector 21: copy of MBR Disk \Device\Harddisk0\DR0 sector 22: copy of MBR Disk \Device\Harddisk0\DR0 sector 23: copy of MBR Disk \Device\Harddisk0\DR0 sector 24: copy of MBR Disk \Device\Harddisk0\DR0 sector 25: copy of MBR Disk \Device\Harddisk0\DR0 sector 26: copy of MBR Disk \Device\Harddisk0\DR0 sector 27: copy of MBR Disk \Device\Harddisk0\DR0 sector 28: copy of MBR Disk \Device\Harddisk0\DR0 sector 29: copy of MBR Disk \Device\Harddisk0\DR0 sector 30: copy of MBR Disk \Device\Harddisk0\DR0 sector 31: copy of MBR Disk \Device\Harddisk0\DR0 sector 32: copy of MBR Disk \Device\Harddisk0\DR0 sector 33: copy of MBR Disk \Device\Harddisk0\DR0 sector 34: copy of MBR Disk \Device\Harddisk0\DR0 sector 35: copy of MBR Disk \Device\Harddisk0\DR0 sector 36: copy of MBR Disk \Device\Harddisk0\DR0 sector 37: copy of MBR Disk \Device\Harddisk0\DR0 sector 38: copy of MBR Disk \Device\Harddisk0\DR0 sector 39: copy of MBR Disk \Device\Harddisk0\DR0 sector 40: copy of MBR Disk \Device\Harddisk0\DR0 sector 41: copy of MBR Disk \Device\Harddisk0\DR0 sector 42: copy of MBR Disk \Device\Harddisk0\DR0 sector 43: copy of MBR Disk \Device\Harddisk0\DR0 sector 44: copy of MBR Disk \Device\Harddisk0\DR0 sector 45: copy of MBR Disk \Device\Harddisk0\DR0 sector 46: copy of MBR Disk \Device\Harddisk0\DR0 sector 47: copy of MBR Disk \Device\Harddisk0\DR0 sector 48: copy of MBR Disk \Device\Harddisk0\DR0 sector 49: copy of MBR Disk \Device\Harddisk0\DR0 sector 50: copy of MBR Disk \Device\Harddisk0\DR0 sector 51: copy of MBR Disk \Device\Harddisk0\DR0 sector 52: copy of MBR Disk \Device\Harddisk0\DR0 sector 53: copy of MBR Disk \Device\Harddisk0\DR0 sector 54: copy of MBR Disk \Device\Harddisk0\DR0 sector 55: copy of MBR Disk \Device\Harddisk0\DR0 sector 56: copy of MBR Disk \Device\Harddisk0\DR0 sector 57: copy of MBR Disk \Device\Harddisk0\DR0 sector 58: copy of MBR Disk \Device\Harddisk0\DR0 sector 59: copy of MBR Disk \Device\Harddisk0\DR0 sector 60: copy of MBR Disk \Device\Harddisk0\DR0 sector 61: copy of MBR Disk \Device\Harddisk0\DR0 sector 62: copy of MBR Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR ---- EOF - GMER 1.0.15 ----
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.