Jump to content

suspicious background activity


Recommended Posts

Hi forum. Wondering if anyone has an idea of whats hiding inside my system...?

Malwarebytes' Anti-Malware 1.45

www.malwarebytes.org

Database version: 3955

Windows 5.1.2600 Service Pack 2

Internet Explorer 8.0.6001.18702

04/05/2010 6:41:29 AM

mbam-log-2010-04-05 (06-41-29).txt

Scan type: Full scan (C:\|D:\|)

Objects scanned: 371636

Time elapsed: 1 hour(s), 20 minute(s), 17 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

00:37:17 Will MESSAGE Protection started successfully

00:37:23 Will MESSAGE IP Protection started successfully

00:46:33 Will IP-BLOCK 210.51.180.239

02:06:23 Will MESSAGE Protection started successfully

02:06:27 Will MESSAGE IP Protection started successfully

02:20:30 Will MESSAGE Protection started successfully

02:20:35 Will MESSAGE IP Protection started successfully

02:29:43 Will IP-BLOCK 210.51.180.239

19:54:22 Will MESSAGE Protection started successfully

19:54:26 Will MESSAGE IP Protection started successfully

20:03:31 Will IP-BLOCK 210.51.180.239

20:30:02 Will MESSAGE Protection started successfully

20:30:07 Will MESSAGE IP Protection started successfully

21:06:49 Will MESSAGE Protection started successfully

21:06:54 Will MESSAGE IP Protection started successfully

DDS (Ver_10-03-17.01) - NTFSx86

Run by Will at 20:33:01.00 on 04/07/2010

Internet Explorer: 8.0.6001.18702

Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.1534.997 [GMT -4:00]

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch

svchost.exe

C:\WINDOWS\System32\svchost.exe -k netsvcs

svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe

C:\WINDOWS\System32\svchost.exe -k imgsvc

C:\Program Files\UPHClean\uphclean.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe

C:\Program Files\SpeedFan\speedfan.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\Documents and Settings\Will\Local Settings\Temporary Internet Files\Content.IE5\30VNFOCO\dds[1].scr

============== Pseudo HJT Report ===============

uStart Page = https://ssl.scroogle.org/

uWindow Title = JWC Sales & Services

mWindow Title = JWC Sales & Services

uSearchAssistant = hxxp://www.google.com/ie

BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll

BHO: RealPlayer Download and Record Plugin for Internet Explorer: {3049c3e9-b461-4bc5-8870-4c09146192ca} - c:\program files\real\realplayer\rpbrowserrecordplugin.dll

BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll

BHO: Java Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll

BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

TB: {5538FB62-F725-4433-A965-91314E8D8E4D} - No File

TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - No File

TB: {C55BBCD6-41AD-48AD-9953-3609C48EACC7} - No File

TB: Ask Toolbar: {d4027c7f-154a-4066-a1ad-4243d8127440} - c:\program files\ask.com\GenericAskToolbar.dll

EB: {32683183-48a0-441b-a342-7c2a440a9478} - No File

EB: {4528BBE0-4E08-11D5-AD55-00010333D0AD} - No File

mRun: [Malwarebytes' Anti-Malware] "c:\program files\malwarebytes' anti-malware\mbamgui.exe" /starttray

StartupFolder: c:\docume~1\will\startm~1\programs\startup\speedfan.lnk - c:\program files\speedfan\speedfan.exe

uPolicies-explorer: NoWinKeys = 01000000

uPolicies-explorer: NoRecentDocsNetHood = 01000000

uPolicies-explorer: NoFileAssociate = 0 (0x0)

mPolicies-explorer: NoFileAssociate = 0 (0x0)

IE: Download Video on This Page - c:\program files\tomato\tubedownload\TDIEPage.html

IE: Download Video This Links To - c:\program files\tomato\tubedownload\TDIELink.html

IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000

IE: {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

IE: {A103A693-F92C-4A81-8F7F-6C80799EFF3D} - c:\program files\tomato\tubedownload\TDIEPage.html

IE: {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - d:\program files\aim95\aim.exe

IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe

IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe

IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll

IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL

Trusted Zone: excite.com\www

Trusted Zone: microsoft.com\*.update

Trusted Zone: taxsoftware.com

Trusted Zone: turbotax.com

Trusted Zone: windowsupdate.com\download

DPF: Microsoft XML Parser for Java - file://c:\windows\java\classes\xmldso.cab

DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} - hxxp://www.apple.com/qtactivex/qtplugin.cab

DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - hxxp://pcpitstop.com/betapit/PCPitStop.CAB

DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} - hxxps://h50203.www5.hp.com/HPISWeb/Customer/cabs/HPISDataManager.CAB

DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab

DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://go.microsoft.com/fwlink/?linkid=39204

DPF: {1842B0EE-B597-11D4-8997-00104BD12D94} - hxxp://pcpitstop.com/internet/pcpConnCheck.cab

DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} - hxxp://download.bitdefender.com/resources/scanner/sources/en/scan8/oscan8.cab

DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1265101243312

DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1265101224578

DPF: {745395C8-D0E1-4227-8586-624CA9A10A8D} - hxxp://ksunlivecam.sonoma.edu/activex/AMC.cab

DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} - hxxp://download.eset.com/special/eos/OnlineScanner.cab

DPF: {7DFDB8FD-B498-4958-B930-38021B94351D} - hxxp://imlive.com/chatsource/ImlCID.cab

DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} - hxxp://128.171.104.32/activex/AxisCamControl.cab

DPF: {924C1588-90C3-4910-B6CA-D57A1C0418FE} - hxxp://bookmarks.yahoo.com/YbConvFav.CAB

DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_18-windows-i586.cab

DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab

DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} - hxxp://driveragent.com/files/driveragent.cab

Notify: !SASWinLogon - c:\program files\superantispyware\SASWINLO.dll

SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

SEH: SABShellExecuteHook Class: {5ae067d3-9afb-48e0-853a-ebb7f4a000da} - c:\program files\superantispyware\SASSEH.DLL

LSA: Authentication Packages = msv1_0 relog_ap

Hosts: 127.0.0.1 www.spywareinfo.com

============= SERVICES / DRIVERS ===============

R0 uGuru;uGuru;c:\windows\system32\drivers\uGuru.SYS [2010-2-6 10752]

R2 Active@ Disk Monitor;Active@ Disk Monitor;c:\program files\lsoft technologies inc\active@ hard disk monitor\DiskMonitorService.exe [2009-12-19 1127944]

R2 MBAMService;MBAMService;c:\program files\malwarebytes' anti-malware\mbamservice.exe [2009-3-31 303952]

R2 NetProbe;NetProbe Packet Driver;c:\windows\system32\drivers\NetProbe.sys [2009-3-24 5365]

R3 GETND5BV;VIA Networking Velocity-Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5bv.sys [2005-2-14 46080]

R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2009-3-31 20824]

S0 ULiAGP;ULi AGP Controller Bus Filter Driver;c:\windows\system32\drivers\uliagp.sys --> c:\windows\system32\drivers\ULiAGP.sys [?]

S1 ai2cnt;ai2cnt;c:\windows\system32\drivers\ai2cnt.sys [2005-10-10 8247]

S1 SASDIFSV;SASDIFSV;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasdifsv.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASDIFSV.SYS [?]

S1 SASKUTIL;SASKUTIL;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\saskutil.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASKUTIL.sys [?]

S2 gupdate1c9b0e9d753fd80;Google Update Service (gupdate1c9b0e9d753fd80);"c:\program files\google\update\googleupdate.exe" /svc --> c:\program files\google\update\GoogleUpdate.exe [?]

S3 cpuz130;cpuz130;\??\c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys --> c:\docume~1\will\locals~1\temp\cpuz130\cpuz_x32.sys [?]

S3 DCamUSBIntel;USB Video Camera for Intel Proshare technology;c:\windows\system32\drivers\usbintel.sys [2002-8-28 15872]

S3 HPUATA;HP CD Writer Plus Controller Driver;c:\windows\system32\drivers\HPUATA.sys [2001-9-24 75776]

S3 motccgp;Motorola USB Composite Device Driver;c:\windows\system32\drivers\motccgp.sys --> c:\windows\system32\drivers\motccgp.sys [?]

S3 motccgpfl;MotCcgpFlService;c:\windows\system32\drivers\motccgpfl.sys [2008-1-6 7680]

S3 MotDev;Motorola Inc. USB Device;c:\windows\system32\drivers\motodrv.sys --> c:\windows\system32\drivers\motodrv.sys [?]

S3 SASENUM;SASENUM;\??\c:\docume~1\will\locals~1\temp\sas_selfextract\sasenum.sys --> c:\docume~1\will\locals~1\temp\sas_selfextract\SASENUM.SYS [?]

S3 TomTomHOMEService;TomTomHOMEService;c:\program files\tomtom home 2\TomTomHOMEService.exe [2009-11-13 92008]

S4 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s --> c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s [?]

S4 Kha78xela;Kha78xela; [x]

S4 ThreadMaster;Thread Master;c:\windows\system32\threadmaster\ThreadMast.exe [2008-2-11 57344]

S4 Viewpoint Manager Service;Viewpoint Manager Service;"c:\program files\viewpoint\common\viewpointservice.exe" --> c:\program files\viewpoint\common\ViewpointService.exe [?]

=============== Created Last 30 ================

2010-04-08 00:16:22 0 ----a-w- c:\documents and settings\will\defogger_reenable

2010-04-07 06:45:13 0 d-----w- c:\program files\UPHClean

2010-04-07 05:08:42 0 d-----w- c:\program files\SUPERAntiSpyware

2010-04-06 03:24:52 221184 ----a-w- c:\windows\system32\wmpns.dll

2010-04-06 02:38:11 0 d-----w- c:\windows\network diagnostic

2010-04-06 02:38:10 144384 ------w- c:\windows\system32\drivers\hdaudbus.sys

2010-04-06 02:38:09 10240 ------w- c:\windows\system32\drivers\sffp_mmc.sys

2010-04-06 02:36:57 19569 ----a-w- c:\windows\003747_.tmp

2010-04-06 02:29:34 29704 ----a-w- c:\windows\system32\uxtuneup.dll

2010-04-02 05:48:59 471552 -c----w- c:\windows\system32\dllcache\aclayers.dll

2010-04-02 05:48:32 3558912 -c----w- c:\windows\system32\dllcache\moviemk.exe

2010-04-02 05:45:55 16736 ----a-w- c:\windows\system32\mucltui.dll.mui

2010-04-02 05:45:54 274288 ----a-w- c:\windows\system32\mucltui.dll

2010-03-29 05:48:32 54156 ---ha-w- c:\windows\QTFont.qfn

2010-03-29 05:48:32 1409 ----a-w- c:\windows\QTFont.for

2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys2.bmp

2010-03-29 02:44:59 0 ---ha-w- c:\windows\SwSys1.bmp

2010-03-29 02:44:25 0 d-----w- c:\program files\AMB Software

2010-03-17 23:53:16 0 d-----w- c:\program files\Network Probe 3

2010-03-10 01:46:17 0 d-----w- C:\Win7

==================== Find3M ====================

2010-03-30 04:46:30 38224 ----a-w- c:\windows\system32\drivers\mbamswissarmy.sys

2010-03-30 04:45:52 20824 ----a-w- c:\windows\system32\drivers\mbam.sys

2010-02-25 06:24:37 916480 ----a-w- c:\windows\system32\wininet.dll

2010-02-19 00:09:42 411368 ----a-w- c:\windows\system32\deploytk.dll

2010-02-02 08:06:55 106496 ----a-w- C:\SUPER_PI.EXE

============= FINISH: 20:35:05.17 ===============

GMER 1.0.15.15281 - http://www.gmer.net

Rootkit scan 2010-04-07 21:22:36

Windows 5.1.2600 Service Pack 3

Running: hlqb16fh[1].exe; Driver: C:\DOCUME~1\Will\LOCALS~1\Temp\fgtdqpow.sys

---- System - GMER 1.0.15 ----

SSDT \??\C:\WINDOWS\system32\Drivers\uphcleanhlp.sys ZwUnloadKey [0xB2D006D0]

---- Kernel code sections - GMER 1.0.15 ----

? C:\WINDOWS\system32\Drivers\uphcleanhlp.sys The system cannot find the file specified. !

---- User code sections - GMER 1.0.15 ----

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D0299A

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D0294A

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D0290E

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D028F2

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D0277E

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D02870

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D027B6

.text C:\Program Files\LSoft Technologies Inc\Active@ Hard Disk Monitor\DiskMonitorService.exe[1708] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D027EE

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D7299A

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D7294A

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D7290E

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D728F2

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D7277E

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D72870

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D727B6

.text C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe[1824] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D727EE

.text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00F5299A

.text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00F5294A

.text C:\WINDOWS\Explorer.EXE[2516] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00F5290E

.text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00F528F2

.text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00F5277E

.text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00F52870

.text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00F527B6

.text C:\WINDOWS\Explorer.EXE[2516] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00F527EE

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 0106299A

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 0106294A

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 0106290E

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01062EA3

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01062EFD

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01062BF0

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 010629B6

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 010637FE

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01062D5C

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 010633D8

.text C:\Program Files\Internet Explorer\iexplore.exe[2656] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 010633E1

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 01BB299A

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 01BB294A

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 01BB290E

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215505 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E9A75 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DD101 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2EDAC4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466E C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E473F C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E4671 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E46DC C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E4542 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E45A4 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E47A2 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4606 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2EDB20 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E4AA7 C:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetReadFile 3D94654B 5 Bytes JMP 01BB2EA3

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetCloseHandle 3D949088 5 Bytes JMP 01BB2EFD

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpOpenRequestA 3D94D508 5 Bytes JMP 01BB2BF0

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!InternetConnectA 3D94DEAE 5 Bytes JMP 01BB29B6

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestW 3D94FABE 5 Bytes JMP 01BB37FE

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] WININET.dll!HttpSendRequestA 3D95EE89 5 Bytes JMP 01BB2D5C

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertGetCertificateChain 77A92F67 5 Bytes JMP 01BB33D8

.text C:\Program Files\Internet Explorer\iexplore.exe[3144] CRYPT32.dll!CertVerifyCertificateChainPolicy 77A9B76F 5 Bytes JMP 01BB33E1

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDestroyKey 77DE9EBC 7 Bytes JMP 00D5299A

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptDecrypt 77DEA129 7 Bytes JMP 00D5294A

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] ADVAPI32.dll!CryptEncrypt 77DEE360 7 Bytes JMP 00D5290E

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!closesocket 71AB3E2B 5 Bytes JMP 00D528F2

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!send 71AB4C27 5 Bytes JMP 00D5277E

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSARecv 71AB4CB5 5 Bytes JMP 00D52870

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!recv 71AB676F 5 Bytes JMP 00D527B6

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3656] WS2_32.dll!WSASend 71AB68FA 5 Bytes JMP 00D527EE

---- User IAT/EAT - GMER 1.0.15 ----

IAT C:\Program Files\Internet Explorer\iexplore.exe[3144] @ C:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] C:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume1 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

AttachedDevice \Driver\Ftdisk \Device\HarddiskVolume2 tdrpman.sys (Acronis Try&Decide and Restore Points Volume Filter Driver/Acronis)

Device \Driver\viamraid \Device\Scsi\viamraid1 8A1EEF30

Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target0Lun0 8A1EEF30

Device \Driver\viamraid \Device\Scsi\viamraid1Port2Path0Target2Lun0 8A1EEF30

AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00158307d501

Reg HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\00158307d501 (not active ControlSet)

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System

Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OOSAFEERASE03.00.00.01MSWINDOWS C8692185F632DB87872C0E13F74D61CD21612668D214CCF6D929C7276895591C97CBAE6F6DF357A0

A9E26AEFBA7AEF6E215AE8C6297EF87C34B818328218D529363E0591FCFEBC9E127BECC74CFEBC9E

1

27BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4

9

80AC79339DB7CE019D40AA5CA2D97226D213B555A9C6AECB7A5D14076E034E8CE8E404E0855E54C4

C

A034698EF5425D5BCAA080A55EF83C34D632455B493CAA2EE559FF513D0BE0916F5A6B98567BE99A

2

425ED5803F379A9E0D860180FD6D994D50E5267AA99623019F921EA55A4109CE227981887C8C3A87

9

84605E726B0A780798EECEEF3DAB9391F54813D8150DBBE7ED9A939676A0BEDF23A00B1D16105FD1

8

E287D21FDBF7DC334D63F094E14C5B3193AE91A08F7A2B30CC535B2C9EF02B96C3F8C37EBF8B013F

7

18715B0C11B88B6D036442C09F78F05FC2295C1DE2CE383A4060CC901A82DCAC9F3B5568C0C9931C

E

25BAF53D795CCB5CD643086BFCF7928CBAAE1DEB05DD8371F411E938E6D763DEA98FC9E1F6C50210

9

E00D25FABA81A96E36076A4DA03B7191898338876013765B411D903EC77C9D4EA95DDAC092F16F01

4

8B399EE9815D84B1745E1B8BC53ADDF744BA005C0FE876EF06C696E233A3E1224D2EA473AF890D59

7

E7DDC78CA1C53EDE0E50FC91E49D8A70510389057863D27777FD

---- Disk sectors - GMER 1.0.15 ----

Disk \Device\Harddisk0\DR0 sector 01: copy of MBR

Disk \Device\Harddisk0\DR0 sector 02: rootkit-like behavior; copy of MBR

Disk \Device\Harddisk0\DR0 sector 03: copy of MBR

Disk \Device\Harddisk0\DR0 sector 04: copy of MBR

Disk \Device\Harddisk0\DR0 sector 05: copy of MBR

Disk \Device\Harddisk0\DR0 sector 06: copy of MBR

Disk \Device\Harddisk0\DR0 sector 07: copy of MBR

Disk \Device\Harddisk0\DR0 sector 08: rootkit-like behavior; copy of MBR

Disk \Device\Harddisk0\DR0 sector 09: copy of MBR

Disk \Device\Harddisk0\DR0 sector 10: copy of MBR

Disk \Device\Harddisk0\DR0 sector 11: copy of MBR

Disk \Device\Harddisk0\DR0 sector 12: copy of MBR

Disk \Device\Harddisk0\DR0 sector 13: copy of MBR

Disk \Device\Harddisk0\DR0 sector 14: copy of MBR

Disk \Device\Harddisk0\DR0 sector 15: copy of MBR

Disk \Device\Harddisk0\DR0 sector 16: copy of MBR

Disk \Device\Harddisk0\DR0 sector 17: copy of MBR

Disk \Device\Harddisk0\DR0 sector 18: copy of MBR

Disk \Device\Harddisk0\DR0 sector 19: copy of MBR

Disk \Device\Harddisk0\DR0 sector 20: copy of MBR

Disk \Device\Harddisk0\DR0 sector 21: copy of MBR

Disk \Device\Harddisk0\DR0 sector 22: copy of MBR

Disk \Device\Harddisk0\DR0 sector 23: copy of MBR

Disk \Device\Harddisk0\DR0 sector 24: copy of MBR

Disk \Device\Harddisk0\DR0 sector 25: copy of MBR

Disk \Device\Harddisk0\DR0 sector 26: copy of MBR

Disk \Device\Harddisk0\DR0 sector 27: copy of MBR

Disk \Device\Harddisk0\DR0 sector 28: copy of MBR

Disk \Device\Harddisk0\DR0 sector 29: copy of MBR

Disk \Device\Harddisk0\DR0 sector 30: copy of MBR

Disk \Device\Harddisk0\DR0 sector 31: copy of MBR

Disk \Device\Harddisk0\DR0 sector 32: copy of MBR

Disk \Device\Harddisk0\DR0 sector 33: copy of MBR

Disk \Device\Harddisk0\DR0 sector 34: copy of MBR

Disk \Device\Harddisk0\DR0 sector 35: copy of MBR

Disk \Device\Harddisk0\DR0 sector 36: copy of MBR

Disk \Device\Harddisk0\DR0 sector 37: copy of MBR

Disk \Device\Harddisk0\DR0 sector 38: copy of MBR

Disk \Device\Harddisk0\DR0 sector 39: copy of MBR

Disk \Device\Harddisk0\DR0 sector 40: copy of MBR

Disk \Device\Harddisk0\DR0 sector 41: copy of MBR

Disk \Device\Harddisk0\DR0 sector 42: copy of MBR

Disk \Device\Harddisk0\DR0 sector 43: copy of MBR

Disk \Device\Harddisk0\DR0 sector 44: copy of MBR

Disk \Device\Harddisk0\DR0 sector 45: copy of MBR

Disk \Device\Harddisk0\DR0 sector 46: copy of MBR

Disk \Device\Harddisk0\DR0 sector 47: copy of MBR

Disk \Device\Harddisk0\DR0 sector 48: copy of MBR

Disk \Device\Harddisk0\DR0 sector 49: copy of MBR

Disk \Device\Harddisk0\DR0 sector 50: copy of MBR

Disk \Device\Harddisk0\DR0 sector 51: copy of MBR

Disk \Device\Harddisk0\DR0 sector 52: copy of MBR

Disk \Device\Harddisk0\DR0 sector 53: copy of MBR

Disk \Device\Harddisk0\DR0 sector 54: copy of MBR

Disk \Device\Harddisk0\DR0 sector 55: copy of MBR

Disk \Device\Harddisk0\DR0 sector 56: copy of MBR

Disk \Device\Harddisk0\DR0 sector 57: copy of MBR

Disk \Device\Harddisk0\DR0 sector 58: copy of MBR

Disk \Device\Harddisk0\DR0 sector 59: copy of MBR

Disk \Device\Harddisk0\DR0 sector 60: copy of MBR

Disk \Device\Harddisk0\DR0 sector 61: copy of MBR

Disk \Device\Harddisk0\DR0 sector 62: copy of MBR

Disk \Device\Harddisk0\DR0 sector 63: rootkit-like behavior; copy of MBR

---- EOF - GMER 1.0.15 ----

Link to post
Share on other sites

 Share

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.