GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-02-23 19:05:18 Windows 6.0.6002 Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK1032GSX rev.AS022M 93,16GB Running: ro9tp2vb.exe; Driver: C:\Users\Rumianek\AppData\Local\Temp\kgrdikod.sys ---- System - GMER 2.1 ---- SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0x8E142AC4] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwAllocateVirtualMemory [0x8E1FE0BA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0x8E1435A2] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0x8E14F63C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0x8E14F688] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0x8E14F822] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0x8E14F5AA] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateSection [0x8E1FE494] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0x8E14F5F2] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThread [0x8E1FE724] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0x8E14F7DC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0x8E144390] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0x8E142B2A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0x8E147B86] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0x8E142716] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0x8E1FE574] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0x8E142B90] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0x8E147F7C] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0x8E144E78] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0x8E14F666] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0x8E14F6AA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0x8E14F846] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0x8E14F5D0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0x8E14747E] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0x8E14F75A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0x8E14F61A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0x8E14786A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0x8E14F800] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0x8E1FE312] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0x8E144CEC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThread [0x8E144842] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0x8E142BF6] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0x8E142C5C] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwSetContextThread [0x8E1FE670] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0x8E1427B0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0x8E142982] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0x8E142910] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0x8E14455A] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0x8E1446BC] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0x8E142A0A] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwTerminateProcess [0x8E1FE3E0] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0x8E1441EA] SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0x8E142CC2] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwWriteVirtualMemory [0x8E1FE244] SSDT \SystemRoot\system32\drivers\aswSP.sys ZwCreateThreadEx [0x8E1FE80E] ---- Kernel code sections - GMER 2.1 ---- .text ntoskrnl.exe!KeInsertQueue + 2FD 82C8C804 4 Bytes [C4, 2A, 14, 8E] {LES EBP, [EDX]; ADC AL, 0x8e} .text ntoskrnl.exe!KeInsertQueue + 321 82C8C828 4 Bytes [BA, E0, 1F, 8E] .text ntoskrnl.exe!KeInsertQueue + 381 82C8C888 4 Bytes [A2, 35, 14, 8E] .text ntoskrnl.exe!KeInsertQueue + 3C1 82C8C8C8 8 Bytes [3C, F6, 14, 8E, 88, F6, 14, ...] {CMP AL, 0xf6; ADC AL, 0x8e; MOV DH, DH; ADC AL, 0x8e} .text ntoskrnl.exe!KeInsertQueue + 3CD 82C8C8D4 4 Bytes [22, F8, 14, 8E] {AND BH, AL; ADC AL, 0x8e} .text ... PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 110 82E0C60F 4 Bytes CALL 8E14555F \SystemRoot\system32\drivers\aswSnx.sys PAGE ntoskrnl.exe!ZwAlpcSendWaitReceivePort + 121 82E3A119 4 Bytes CALL 8E145575 \SystemRoot\system32\drivers\aswSnx.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Real\RealPlayer\Update\realsched.exe[1116] kernel32.dll!SetUnhandledExceptionFilter 770AA9BD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4} .text C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[1640] kernel32.dll!SetUnhandledExceptionFilter 770AA9BD 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Windows\Explorer.EXE[1836] SHELL32.dll!SHFileOperationW 75E668E0 5 Bytes JMP 10001102 C:\Program Files\Unlocker\UnlockerHook.dll .text C:\Program Files\Alwil Software\Avast5\avastui.exe[3396] kernel32.dll!SetUnhandledExceptionFilter 770AA9BD 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP } .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!LdrLoadDll 77709378 5 Bytes JMP 74381F42 C:\Program Files\Mozilla Firefox\mozglue.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!LdrUnloadDll 7771B680 5 Bytes JMP 000603FC .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtCreateFile 77744264 5 Bytes JMP 54D89AE0 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtFlushBuffersFile 77744764 5 Bytes JMP 54D6C434 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtQueryFullAttributesFile 77744C94 5 Bytes JMP 54D6C150 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtReadFile 77744EC4 5 Bytes JMP 54D6C330 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtReadFileScatter 77744ED4 5 Bytes JMP 5578F60F C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtWriteFile 777454D4 5 Bytes JMP 54D8A9F0 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] ntdll.dll!NtWriteFileGather 777454E4 5 Bytes JMP 5578F5BE C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] KERNEL32.dll!HeapSetInformation + 26 770AA9B8 7 Bytes JMP 54D863D0 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] KERNEL32.dll!LockResource + C 770C6BD3 7 Bytes JMP 556B4AA0 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] KERNEL32.dll!VirtualAllocEx + 54 770CB030 7 Bytes JMP 556B4AC3 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] user32.dll!GetWindowInfo 76DE428E 5 Bytes JMP 555AB991 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[4800] GDI32.dll!SetStretchBltMode + 256 7694745C 7 Bytes JMP 556B4A21 C:\Program Files\Mozilla Firefox\xul.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [745B7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [745F5EFD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [745BBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [745AF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [745B75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [745AE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [746092D5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [745BDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [745AFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [745AFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [745A71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [7463CB4D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [745DC840] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [745AD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [745A6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [745A687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll IAT C:\Windows\Explorer.EXE[1836] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [745B2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.19281_none_9e5912a4ca101004\gdiplus.dll ---- Devices - GMER 2.1 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys AttachedDevice \Driver\tdx \Device\Tcp aswTdi.sys AttachedDevice \Driver\tdx \Device\Udp aswTdi.sys ---- EOF - GMER 2.1 ----