GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-09-10 22:22:46 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST500LM000-1EJ162 rev.SM28 465,76GB Running: 1ihcm1p1.exe; Driver: C:\Users\pysiol\AppData\Local\Temp\afkdipog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1552] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076c48769 4 bytes [C2, 04, 00, 00] .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076951401 2 bytes JMP 76c6b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076951419 2 bytes JMP 76c6b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076951431 2 bytes JMP 76ce8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007695144a 2 bytes CALL 76c44885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769514dd 2 bytes JMP 76ce8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769514f5 2 bytes JMP 76ce8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007695150d 2 bytes JMP 76ce8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076951525 2 bytes JMP 76ce8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007695153d 2 bytes JMP 76c5fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076951555 2 bytes JMP 76c668df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007695156d 2 bytes JMP 76ce8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076951585 2 bytes JMP 76ce8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007695159d 2 bytes JMP 76ce86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769515b5 2 bytes JMP 76c5fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769515cd 2 bytes JMP 76c6b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769516b2 2 bytes JMP 76ce8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\VAIO Event Service\VESMgrSub.exe[2284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769516bd 2 bytes JMP 76ce8681 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegDeleteValueW] [7fee8dabbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msiexec.exe[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CopyFileW] [7fee8daa184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CopyFileW] [7fee8daa184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!SetFileSecurityW] [7fee8dabcb0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExA] [7fee8daba0c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteValueW] [7fee8dabbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteKeyW] [7fee8dad12c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileW] [7fee8daa6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\msi.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!CopyFileW] [7fee8daa184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileW] [7fee8daa6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesA] [7fee8daab7c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileA] [7fee8daa2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CopyFileW] [7fee8daa184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\sfc_os.DLL[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!PrivCopyFileExW] [7fee8daab04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!OpenFile] [7fee8daa890] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.DLL[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.18837_none_fa3b1e3d17594757\COMCTL32.DLL[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegDeleteValueW] [7fee8dabbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileW] [7fee8daa6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!_lwrite] [7fee8daaa1c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileA] [7fee8daa2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegCreateKeyExA] [7fee8dab3dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegSetValueExA] [7fee8daba0c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CSCDLL.DLL[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!CreateFileA] [7fee8daa2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\GPAPI.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINSTA.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\WINHTTP.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\webio.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\webio.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegDeleteValueW] [7fee8dabbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CopyFileW] [7fee8daa184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileA] [7fee8daa2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegSetValueExW] [7fee8dabaa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegDeleteValueW] [7fee8dabbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegCreateKeyExW] [7fee8dab4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegOpenKeyExW] [7fee8dab6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fefd434230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileW] [7fee8daa6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!DeleteFileW] [7fee8daa5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fee8daabe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileW] [7fee8daa42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileW] [7fee8daa6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[4464] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileExW] [7fee8daa804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files (x86)\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x72 0x84 0x88 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x6C 0x6B 0x89 0x66 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xF5 0x7A 0xCD 0xFF ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files (x86)\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0xEA 0x72 0x84 0x88 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0x6C 0x6B 0x89 0x66 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xF5 0x7A 0xCD 0xFF ... ---- EOF - GMER 2.1 ----