GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-04-30 11:00:00 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T1L0-2 Samsung_SSD_840_Series rev.DXT06B0Q 232,88GB Running: 17v0xsxk.exe; Driver: C:\Users\admin11\AppData\Local\Temp\uglciaoc.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000778e0048 5 bytes JMP 0000000069921986 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Security Scan\kss.exe[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 00000000721f17fa 2 bytes CALL 76f611a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 00000000721f1860 2 bytes CALL 76f611a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 00000000721f1942 2 bytes JMP 77076da1 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 00000000721f194d 2 bytes JMP 7707e8de C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2540] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[2564] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\vmnat.exe[2888] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 4 00000000721c13b0 2 bytes JMP 75f555d0 C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\vmnat.exe[2888] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 20 00000000721c13c0 2 bytes CALL 773f9cee C:\Windows\syswow64\msvcrt.dll .text ... * 20 .text C:\Windows\SysWOW64\vmnat.exe[2888] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 22 00000000721c153e 2 bytes CALL 75fe7364 C:\Windows\syswow64\SHELL32.dll .text C:\Windows\SysWOW64\vmnat.exe[2888] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 43 00000000721c1553 2 bytes CALL 76f610ff C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[3048] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[4344] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dropbox\Client\Dropbox.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4204] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ec1401 2 bytes JMP 76f8b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ec1419 2 bytes JMP 76f8b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ec1431 2 bytes JMP 77009149 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ec144a 2 bytes CALL 76f64885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ec14dd 2 bytes JMP 77008a42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ec14f5 2 bytes JMP 77008c18 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ec150d 2 bytes JMP 77008938 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ec1525 2 bytes JMP 77008d02 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ec153d 2 bytes JMP 76f7fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ec1555 2 bytes JMP 76f86907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ec156d 2 bytes JMP 77009201 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ec1585 2 bytes JMP 77008d62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ec159d 2 bytes JMP 770088fc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ec15b5 2 bytes JMP 76f7fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ec15cd 2 bytes JMP 76f8b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ec16b2 2 bytes JMP 770090c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3008] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ec16bd 2 bytes JMP 77008891 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.2 ---- IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Program Files\Internet Explorer\IEXPLORE.EXE[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7feeef20750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7feeef461b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7feeef20750] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7feeef460d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7feeef460d0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7feeef46f30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Program Files\Internet Explorer\sqmapi.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\POWRPROF.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MSHTML.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MSHTML.dll[USER32.dll!MessageBoxW] [7feeef46840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MSHTML.dll[USER32.dll!DialogBoxParamW] [7feeef462b0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\MSHTML.dll[USER32.dll!EnableWindow] [7feeef0ef00] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\IEXPLORE.EXE[684] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7feeef01c40] C:\Program Files\Internet Explorer\IEShims.dll ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0003c9355af4 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001b10002aec Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001b10002aec@00023c654d04 0xE7 0x6F 0x53 0x4B ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0003c9355af4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001b10002aec (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001b10002aec@00023c654d04 0xE7 0x6F 0x53 0x4B ... ---- EOF - GMER 2.2 ----