GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-13 22:02:34 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD10EZEX-00BN5A0 rev.01.01A01 931,51GB Running: otp20lxi.exe; Driver: C:\Users\Bartek\AppData\Local\Temp\pgddapow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000073e317fa 2 bytes CALL 76dd11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000073e31860 2 bytes CALL 76dd11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000073e31942 2 bytes JMP 771e7089 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000073e3194d 2 bytes JMP 771ecba6 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2740] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Internet Explorer\iexplore.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll 0000000077b43210 6 bytes {NOP ; JMP 0xffffffff8887d54c} .text C:\Program Files\Internet Explorer\iexplore.exe[2636] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 0000000077b47100 6 bytes {NOP ; JMP 0xffffffff888792a4} .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d3af51 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d43b9b 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5068] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d3af51 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d43b9b 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4568] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d3af51 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d43b9b 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[1988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d3af51 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d43b9b 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\SysWOW64\ntdll.dll!LdrLoadDll 0000000077d3af51 5 bytes JMP 00000001000301f8 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\SysWOW64\ntdll.dll!LdrUnloadDll 0000000077d43b9b 5 bytes JMP 00000001000303fc .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076db1401 2 bytes JMP 76dfb21b C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076db1419 2 bytes JMP 76dfb346 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076db1431 2 bytes JMP 76e78f29 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000076db144a 2 bytes CALL 76dd489d C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000076db14dd 2 bytes JMP 76e78822 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000076db14f5 2 bytes JMP 76e789f8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000076db150d 2 bytes JMP 76e78718 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076db1525 2 bytes JMP 76e78ae2 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000076db153d 2 bytes JMP 76defca8 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076db1555 2 bytes JMP 76df68ef C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000076db156d 2 bytes JMP 76e78fe3 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076db1585 2 bytes JMP 76e78b42 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000076db159d 2 bytes JMP 76e786dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000076db15b5 2 bytes JMP 76defd41 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000076db15cd 2 bytes JMP 76dfb2dc C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000076db16b2 2 bytes JMP 76e78ea4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000076db16bd 2 bytes JMP 76e78671 C:\Windows\syswow64\KERNEL32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7feeec8d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7feeecb63e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7feeec8d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7feeecb6300] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\comctl32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7feeecb6300] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7feeecb7160] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\mshtml.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\mshtml.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\mshtml.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\mshtml.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\Wpc.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\wevtapi.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ImgUtil.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7feeecb64e0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7feeec73370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\NLSData0000.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Program Files\Windows Defender\MpOav.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\WINMM.dll[USER32.dll!MessageBoxW] [7feeecb6a70] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[2636] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress] [7feeec71800] C:\Program Files\Internet Explorer\IEShims.dll ---- Processes - GMER 2.1 ---- Process C:\Users\Bartek\AppData\Roaming\wimsmrh.exe (*** suspicious ***) @ C:\Users\Bartek\AppData\Roaming\wimsmrh.exe [3544](2015-07-12 19:13:17) 0000000000320000 ---- EOF - GMER 2.1 ----