Lin0 Posted April 8, 2010 ID:228931 Share Posted April 8, 2010 Hi forum. Wondering if anyone has an idea of whats hiding inside my system...?Malwarebytes' Anti-Malware 1.45www.malwarebytes.orgDatabase version: 3955Windows 5.1.2600 Service Pack 2Internet Explorer 8.0.6001.1870204/05/2010 6:41:29 AMmbam-log-2010-04-05 (06-41-29).txtScan type: Full scan (C:\|D:\|)Objects scanned: 371636Time elapsed: 1 hour(s), 20 minute(s), 17 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)00:37:17 Will MESSAGE Protection started successfully00:37:23 Will MESSAGE IP Protection started successfully00:46:33 Will IP-BLOCK 210.51.180.23902:06:23 Will MESSAGE Protection started successfully02:06:27 Will MESSAGE IP Protection started successfully02:20:30 Will MESSAGE Protection started successfully02:20:35 Will MESSAGE IP Protection started successfully02:29:43 Will IP-BLOCK 210.51.180.23919:54:22 Will MESSAGE Protection started successfully19:54:26 Will MESSAGE IP Protection started successfully20:03:31 Will IP-BLOCK 210.51.180.23920:30:02 Will MESSAGE Protection started successfully20:30:07 Will MESSAGE IP Protection started successfully21:06:49 Will MESSAGE Protection started successfully21:06:54 Will MESSAGE IP Protection started successfullyDDS (Ver_10-03-17.01) - NTFSx86 Run by Will at 20:33:01.00 on 04/07/2010Internet Explorer: 8.0.6001.18702Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.997 [GMT -4:00]============== Running Processes ===============C:\WINDOWS\system32\svchost -k DcomLaunchsvchost.exeC:\WINDOWS\System32\svchost.exe -k netsvcssvchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exeC:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exeC:\WINDOWS\System32\svchost.exe -k imgsvcC:\Program Files\UPHClean\uphclean.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exeC:\Program Files\SpeedFan\speedfan.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\Will\Local Settings\Temporary Internet Files\Content.IE5\30VNFOCO\dds[1].scr============== Pseudo HJT Report ===============uStart Page = https://ssl.scroogle.org/uWindow Title = JWC Sales & ServicesmWindow Title = JWC Sales & ServicesuSearchAssistant = hxxp://www.google.com/ieBHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dllBHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dllBHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dllBHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dllBHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dllTB: {5538FB62-F725-4433-A965-91314E8D8E4D} - No FileTB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No FileTB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No FileTB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dllEB: {32683183-48a0-441b-a342-7c2a440a9478} - No FileEB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No FilemRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttrayStartupFolder: c:\docume~1\will\startm~1\programs\startup\speedfan.lnk - c:\program files\speedfan\speedfan.exeuPolicies-explorer: NoWinKeys = 01000000uPolicies-explorer: NoRecentDocsNetHood = 01000000uPolicies-explorer: NoFileAssociate = 0 (0x0)mPolicies-explorer: NoFileAssociate = 0 (0x0)IE: Download Video on This Page - c:\program files\tomato\tubedownload\TDIEPage.htmlIE: Download Video This Links To - c:\program files\tomato\tubedownload\TDIELink.htmlIE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exeIE: {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - c:\program files\tomato\tubedownload\TDIEPage.htmlIE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - d:\program files\aim95\aim.exeIE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exeIE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exeIE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dllIE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLLTrusted Zone: excite.com\wwwTrusted Zone: microsoft.com\*.updateTrusted Zone: taxsoftware.comTrusted Zone: turbotax.comTrusted Zone: windowsupdate.com\downloadDPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cabDPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cabDPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CABDPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CABDPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cabDPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - hxxp://pcpitstop.com/internet/pcpConnCheck.cabDPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cabDPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265101243312DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265101224578DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - hxxp://ksunlivecam.sonoma.edu/activex/AMC.cabDPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cabDPF: {7DFDB8FD-B498-4958-B930-38021B94351D} - hxxp://imlive.com/chatsource/ImlCID.cabDPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cabDPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://128.171.104.32/activex/AxisCamControl.cabDPF: {924C1588-90C3-4910-B6CA-D57A1C0418FE} - hxxp://bookmarks.yahoo.com/YbConvFav.CABDPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cabDPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cabDPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cabNotify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dllSSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dllSEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLLLSA: Authentication Packages = msv1_0 relog_apHosts: 127.0.0.1 www.spywareinfo.com============= SERVICES / DRIVERS ===============R0 uGuru;uGuru;c:\windows\system32\drivers\uGuru.SYS [2010-2-6 10752]R2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\lsoft technologies inc\active@ hard disk monitor\DiskMonitorService.exe [2009-12-19 1127944]R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-31 303952]R2 NetProbe;NetProbe Packet Driver;c:\windows\system32\drivers\NetProbe.sys [2009-3-24 5365]R3 GETND5BV;VIA Networking Velocity-Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5bv.sys [2005-2-14 46080]R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-31 20824]S0 ULiAGP;ULi AGP Controller Bus Filter Driver;c:\windows\system32\drivers\uliagp.sys --> c:\windows\system32\drivers\ULiAGP.sys [?]S1 ai2cnt;ai2cnt;c:\windows\system32\drivers\ai2cnt.sys [2005-10-10 8247]S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasdifsv.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASDIFSV.SYS [?]S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\saskutil.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASKUTIL.sys [?]S2 gupdate1c9b0e9d753fd80;Google Update Service (gupdate1c9b0e9d753fd80);"c:\program files\google\update\googleupdate.exe" /svc --> c:\program files\google\update\GoogleUpdate.exe [?]S3 cpuz130;cpuz130;\??\c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys --> c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys [?]S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;c:\windows\system32\drivers\usbintel.sys [2002-8-28 15872]S3 HPUATA;HP CD Writer Plus Controller Driver;c:\windows\system32\drivers\HPUATA.sys [2001-9-24 75776]S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys --> c:\windows\system32\drivers\motccgp.sys [?]S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-1-6 7680]S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys --> c:\windows\system32\drivers\motodrv.sys [?]S3 SASENUM;SASENUM;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasenum.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASENUM.SYS [?]S3 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s --> c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s [?]S4 Kha78xela;Kha78xela; [x]S4 ThreadMaster;Thread Master;c:\windows\system32\threadmaster\ThreadMast.exe [2008-2-11 57344]S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]=============== Created Last 30 ================2010-04-08 00:16:22 0 ----a-w- c:\documents and settings\will\defogger_reenable2010-04-07 06:45:13 0 d-----w- c:\program files\UPHClean2010-04-07 05:08:42 0 d-----w- c:\program files\SUPERAntiSpyware2010-04-06 03:24:52 221184 ----a-w- c:\windows\system32\wmpns.dll2010-04-06 02:38:11 0 d-----w- c:\windows\network diagnostic2010-04-06 02:38:10 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys2010-04-06 02:38:09 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys2010-04-06 02:36:57 19569 ----a-w- c:\windows\003747_.tmp2010-04-06 02:29:34 29704 ----a-w- c:\windows\system32\uxtuneup.dll2010-04-02 05:48:59 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll2010-04-02 05:48:32 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe2010-04-02 05:45:55 16736 ----a-w- c:\windows\system32\mucltui.dll.mui2010-04-02 05:45:54 274288 ----a-w- c:\windows\system32\mucltui.dll2010-03-29 05:48:32 54156 ---ha-w- c:\windows\QTFont.qfn2010-03-29 05:48:32 1409 ----a-w- c:\windows\QTFont.for2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys2.bmp2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys1.bmp2010-03-29 02:44:25 0 d-----w- c:\program files\AMB Software2010-03-17 23:53:16 0 d-----w- c:\program files\Network Probe 32010-03-10 01:46:17 0 d-----w- C:\Win7==================== Find3M ====================2010-03-30 04:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys2010-03-30 04:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll2010-02-19 00:09:42 411368 ----a-w- c:\windows\system32\deploytk.dll2010-02-02 08:06:55 106496 ----a-w- C:\SUPER_PI.EXE============= FINISH: 20:35:05.17 ===============GMER 1.0.15.15281 - http://www.gmer.netRootkit scan 2010-04-07 21:22:36Windows 5.1.2600 Service Pack 3Running: hlqb16fh[1].exe; Driver: C:\DOCUME~1\Will\LOCALS~1\Temp\fgtdqpow.sys---- System - GMER 1.0.15 ----SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0xB2D006D0]---- Kernel code sections - GMER 1.0.15 ----? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys The system cannot find the file specified. !---- User code sections - GMER 1.0.15 ----.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D0299A .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D0294A .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D0290E .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D028F2 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D0277E .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D02870 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D027B6 .text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D027EE .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D7299A .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D7294A .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D7290E .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D728F2 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D7277E .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D72870 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D727B6 .text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D727EE .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00F5299A .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00F5294A .text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00F5290E .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F528F2 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F5277E .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00F52870 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F527B6 .text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00F527EE .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 0106299A .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 0106294A .text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 0106290E .text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01062EA3 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01062EFD .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01062BF0 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 010629B6 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 010637FE .text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01062D5C .text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 010633D8 .text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 010633E1 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 01BB299A .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 01BB294A .text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 01BB290E .text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation).text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01BB2EA3 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01BB2EFD .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01BB2BF0 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 01BB29B6 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 01BB37FE .text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01BB2D5C .text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 01BB33D8 .text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 01BB33E1 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D5299A .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D5294A .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D5290E .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D528F2 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D5277E .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D52870 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D527B6 .text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D527EE ---- User IAT/EAT - GMER 1.0.15 ----IAT C:\Program Files\Internet Explorer\iexplore.exe[3144] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)---- Devices - GMER 1.0.15 ----AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)Device \Driver\viamraid \Device\Scsi\viamraid1 8A1EEF30Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target0Lun0 8A1EEF30Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target2Lun0 8A1EEF30AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)---- Registry - GMER 1.0.15 ----Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158307d501 Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00158307d501 (not active ControlSet) Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE03.00.00.01MSWINDOWS C8692185F632DB87872C0E13F74D61CD21612668D214CCF6D929C7276895591C97CBAE6F6DF357A0A9E26AEFBA7AEF6E215AE8C6297EF87C34B818328218D529363E0591FCFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC79339DB7CE019D40AA5CA2D97226D213B555A9C6AECB7A5D14076E034E8CE8E404E0855E54C4CA034698EF5425D5BCAA080A55EF83C34D632455B493CAA2EE559FF513D0BE0916F5A6B98567BE99A2425ED5803F379A9E0D860180FD6D994D50E5267AA99623019F921EA55A4109CE227981887C8C3A87984605E726B0A780798EECEEF3DAB9391F54813D8150DBBE7ED9A939676A0BEDF23A00B1D16105FD18E287D21FDBF7DC334D63F094E14C5B3193AE91A08F7A2B30CC535B2C9EF02B96C3F8C37EBF8B013F718715B0C11B88B6D036442C09F78F05FC2295C1DE2CE383A4060CC901A82DCAC9F3B5568C0C9931CE25BAF53D795CCB5CD643086BFCF7928CBAAE1DEB05DD8371F411E938E6D763DEA98FC9E1F6C502109E00D25FABA81A96E36076A4DA03B7191898338876013765B411D903EC77C9D4EA95DDAC092F16F0148B399EE9815D84B1745E1B8BC53ADDF744BA005C0FE876EF06C696E233A3E1224D2EA473AF890D597E7DDC78CA1C53EDE0E50FC91E49D8A70510389057863D27777FD---- Disk sectors - GMER 1.0.15 ----Disk \Device\Harddisk0\DR0 sector 01: copy of MBRDisk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior; copy of MBRDisk \Device\Harddisk0\DR0 sector 03: copy of MBRDisk \Device\Harddisk0\DR0 sector 04: copy of MBRDisk \Device\Harddisk0\DR0 sector 05: copy of MBRDisk \Device\Harddisk0\DR0 sector 06: copy of MBRDisk \Device\Harddisk0\DR0 sector 07: copy of MBRDisk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior; copy of MBRDisk \Device\Harddisk0\DR0 sector 09: copy of MBRDisk \Device\Harddisk0\DR0 sector 10: copy of MBRDisk \Device\Harddisk0\DR0 sector 11: copy of MBRDisk \Device\Harddisk0\DR0 sector 12: copy of MBRDisk \Device\Harddisk0\DR0 sector 13: copy of MBRDisk \Device\Harddisk0\DR0 sector 14: copy of MBRDisk \Device\Harddisk0\DR0 sector 15: copy of MBRDisk \Device\Harddisk0\DR0 sector 16: copy of MBRDisk \Device\Harddisk0\DR0 sector 17: copy of MBRDisk \Device\Harddisk0\DR0 sector 18: copy of MBRDisk \Device\Harddisk0\DR0 sector 19: copy of MBRDisk \Device\Harddisk0\DR0 sector 20: copy of MBRDisk \Device\Harddisk0\DR0 sector 21: copy of MBRDisk \Device\Harddisk0\DR0 sector 22: copy of MBRDisk \Device\Harddisk0\DR0 sector 23: copy of MBRDisk \Device\Harddisk0\DR0 sector 24: copy of MBRDisk \Device\Harddisk0\DR0 sector 25: copy of MBRDisk \Device\Harddisk0\DR0 sector 26: copy of MBRDisk \Device\Harddisk0\DR0 sector 27: copy of MBRDisk \Device\Harddisk0\DR0 sector 28: copy of MBRDisk \Device\Harddisk0\DR0 sector 29: copy of MBRDisk \Device\Harddisk0\DR0 sector 30: copy of MBRDisk \Device\Harddisk0\DR0 sector 31: copy of MBRDisk \Device\Harddisk0\DR0 sector 32: copy of MBRDisk \Device\Harddisk0\DR0 sector 33: copy of MBRDisk \Device\Harddisk0\DR0 sector 34: copy of MBRDisk \Device\Harddisk0\DR0 sector 35: copy of MBRDisk \Device\Harddisk0\DR0 sector 36: copy of MBRDisk \Device\Harddisk0\DR0 sector 37: copy of MBRDisk \Device\Harddisk0\DR0 sector 38: copy of MBRDisk \Device\Harddisk0\DR0 sector 39: copy of MBRDisk \Device\Harddisk0\DR0 sector 40: copy of MBRDisk \Device\Harddisk0\DR0 sector 41: copy of MBRDisk \Device\Harddisk0\DR0 sector 42: copy of MBRDisk \Device\Harddisk0\DR0 sector 43: copy of MBRDisk \Device\Harddisk0\DR0 sector 44: copy of MBRDisk \Device\Harddisk0\DR0 sector 45: copy of MBRDisk \Device\Harddisk0\DR0 sector 46: copy of MBRDisk \Device\Harddisk0\DR0 sector 47: copy of MBRDisk \Device\Harddisk0\DR0 sector 48: copy of MBRDisk \Device\Harddisk0\DR0 sector 49: copy of MBRDisk \Device\Harddisk0\DR0 sector 50: copy of MBRDisk \Device\Harddisk0\DR0 sector 51: copy of MBRDisk \Device\Harddisk0\DR0 sector 52: copy of MBRDisk \Device\Harddisk0\DR0 sector 53: copy of MBRDisk \Device\Harddisk0\DR0 sector 54: copy of MBRDisk \Device\Harddisk0\DR0 sector 55: copy of MBRDisk \Device\Harddisk0\DR0 sector 56: copy of MBRDisk \Device\Harddisk0\DR0 sector 57: copy of MBRDisk \Device\Harddisk0\DR0 sector 58: copy of MBRDisk \Device\Harddisk0\DR0 sector 59: copy of MBRDisk \Device\Harddisk0\DR0 sector 60: copy of MBRDisk \Device\Harddisk0\DR0 sector 61: copy of MBRDisk \Device\Harddisk0\DR0 sector 62: copy of MBRDisk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR---- EOF - GMER 1.0.15 ---- Link to post Share on other sites More sharing options...
Recommended Posts