GMER 2.1.19081 - http://www.gmer.net Rootkit scan 2013-02-20 23:50:16 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST3500320AS rev.SD1A 465,76GB Running: k5qzx8m9.exe; Driver: C:\Users\Michal0z\AppData\Local\Temp\fwloqaog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076491401 2 bytes JMP 76c8eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076491419 2 bytes JMP 76c9b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076491431 2 bytes JMP 76d18609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007649144a 2 bytes CALL 76c71dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000764914dd 2 bytes JMP 76d17efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000764914f5 2 bytes JMP 76d180d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007649150d 2 bytes JMP 76d17df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076491525 2 bytes JMP 76d181c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007649153d 2 bytes JMP 76c8f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076491555 2 bytes JMP 76c9b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007649156d 2 bytes JMP 76d186c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076491585 2 bytes JMP 76d18222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007649159d 2 bytes JMP 76d17db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000764915b5 2 bytes JMP 76c8f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000764915cd 2 bytes JMP 76c9b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000764916b2 2 bytes JMP 76d18584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1516] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000764916bd 2 bytes JMP 76d17d4d C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiexec.exe[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CopyFileW] [7fee8c1a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CopyFileW] [7fee8c1a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!SetFileSecurityW] [7fee8c1bea8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExA] [7fee8c1bc04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteKeyW] [7fee8c1d0cc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msi.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesA] [7fee8c1ad74] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileA] [7fee8c1a4d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CopyFileW] [7fee8c1a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!CopyFileW] [7fee8c1a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\sfc_os.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!PrivCopyFileExW] [7fee8c1acfc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!OpenFile] [7fee8c1aa88] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6\COMCTL32.DLL[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6\COMCTL32.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!_lwrite] [7fee8c1ac14] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileA] [7fee8c1a4d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegCreateKeyExA] [7fee8c1b5d4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegSetValueExA] [7fee8c1bc04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!CopyFileExW] [7fee8c1a458] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ATL.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ATL.DLL[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VssTrace.DLL[KERNEL32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ntmarta.dll[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ntmarta.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ntmarta.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CopyFileW] [7fee8c1a37c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileA] [7fee8c1a4d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fee8c1add8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8c1b6ec] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8c1b8c8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileExW] [7fee8c1a9fc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!_lcreat] [7fee8c1ab98] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!_lopen] [7fee8c1ab1c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!_lwrite] [7fee8c1ac14] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!DeleteFileA] [7fee8c1a778] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\VERSION.DLL[KERNEL32.dll!MoveFileW] [7fee8c1a8d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!RegDeleteValueA] [7fee8c1bd3c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!RegSetValueExA] [7fee8c1bc04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!DeleteFileW] [7fee8c1a7dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!CreateFileW] [7fee8c1a624] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!RegOpenKeyExA] [7fee8c1b804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!RegDeleteValueW] [7fee8c1bdc0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\propsys.dll[KERNEL32.dll!RegSetValueExW] [7fee8c1bca0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiltcfg.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\msiltcfg.dll[ADVAPI32.dll!AccessCheck] [7fee8c1a284] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[3856] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fefd13a7d0] C:\Windows\system32\apphelp.dll ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [2668:1868] 000007feedfba0ac ---- EOF - GMER 2.1 ----