GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-03-04 19:48:06 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB Running: jt4zo3mb.exe; Driver: C:\Users\Jarek\AppData\Local\Temp\awddykog.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2728] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Viatax\Viatax.exe[3316] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3480] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[776] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4124] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000763f1401 2 bytes JMP 75fdb233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000763f1419 2 bytes JMP 75fdb35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000763f1431 2 bytes JMP 76059011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000763f144a 2 bytes CALL 75fb48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763f14dd 2 bytes JMP 7605890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763f14f5 2 bytes JMP 76058ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000763f150d 2 bytes JMP 76058800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000763f1525 2 bytes JMP 76058bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000763f153d 2 bytes JMP 75fcfcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000763f1555 2 bytes JMP 75fd6907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000763f156d 2 bytes JMP 760590c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000763f1585 2 bytes JMP 76058c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000763f159d 2 bytes JMP 760587c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763f15b5 2 bytes JMP 75fcfd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763f15cd 2 bytes JMP 75fdb2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763f16b2 2 bytes JMP 76058f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Google\Update\GoogleUpdate.exe[1608] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763f16bd 2 bytes JMP 76058759 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Windows\Explorer.EXE[1528] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!FreeLibraryAndExitThread] [10002370] C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll IAT C:\Windows\Explorer.EXE[1528] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateThread] [100034e0] C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll IAT C:\Windows\Explorer.EXE[1528] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!LoadLibraryA] [100011e0] C:\Program Files (x86)\EgisTec MyWinLocker\x64\psdprotect.dll IAT C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe[2168] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!LoadLibraryA] [13fe81ae0] C:\Program Files\Common Files\McAfee\SystemCore\mfevtps.exe IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7fef2f50750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7fef2f761b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7fef2f50750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef2f760d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef2f760d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7fef2f76f30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINSPOOL.DRV[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINSPOOL.DRV[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINSPOOL.DRV[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\Wpc.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\thumbcache.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHDOCVW.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SHDOCVW.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\SearchFolder.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\NetworkExplorer.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINMM.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\WINSTA.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\System32\DAVHLPR.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\PortableDeviceApi.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\EhStorAPI.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\cabview.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\cabview.dll[USER32.dll!MessageBoxW] [7fef2f76840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\zipfldr.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\zipfldr.dll[USER32.dll!EnableWindow] [7fef2f3ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Windows\system32\zipfldr.dll[USER32.dll!DialogBoxParamW] [7fef2f762b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3592] @ C:\Program Files\Windows Defender\MpOav.dll[KERNEL32.dll!GetProcAddress] [7fef2f31c40] C:\Program Files\Internet Explorer\IEShims.dll ---- Threads - GMER 2.2 ---- Thread C:\Windows\system32\svchost.exe [700:3620] 000007fef2ec0ea8 Thread C:\Windows\system32\svchost.exe [700:3868] 000007fef2eb9db0 Thread C:\Windows\system32\svchost.exe [700:2544] 000007fef2ebaa10 Thread C:\Windows\system32\svchost.exe [700:2576] 000007fef2ec1c94 Thread C:\Windows\system32\svchost.exe [700:4684] 000007fef1e55c24 Thread C:\Windows\system32\svchost.exe [700:4368] 000007fef1e5eff0 Thread C:\Windows\system32\svchost.exe [700:2436] 000007fef2024f84 Thread C:\Windows\system32\svchost.exe [700:2516] 000007fef0c1c2d4 Thread C:\Windows\system32\svchost.exe [700:2416] 000007fef0c1c2d4 Thread C:\Windows\system32\svchost.exe [700:2464] 000007fef0c1c2d4 Thread C:\Windows\system32\svchost.exe [700:2456] 000007fef0c1c2d4 Thread C:\Windows\system32\svchost.exe [700:1308] 000007fefaf75124 Thread C:\Windows\System32\svchost.exe [4220:3236] 000007fef09d9688 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001583161c8b Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001583161c8b (not active ControlSet) ---- Files - GMER 2.2 ---- File C:\Windows\System32\Tasks\psv_Tressunzap 3258 bytes ---- EOF - GMER 2.2 ----