API tools faq
paste
Advertisement
Guest User

Untitled

a guest
Oct 24th, 2013
48
0
Never
Add comment
Not a member of Pastebin yet? Sign Up, it unlocks many cool features!
text 42.68 KB | None | 0 0
raw download clone embed print report
  1. GMER 2.1.19163 - http://www.gmer.net
  2. Rootkit scan 2013-10-25 01:33:34
  3. Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800JB-00FMA0 rev.13.03G13 74,53GB
  4. Running: 4c44ns24.exe; Driver: C:\DOCUME~1\Kasia\USTAWI~1\Temp\fxadyaoc.sys
  5.  
  6.  
  7. ---- System - GMER 2.1 ----
  8.  
  9. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xBA47A610]
  10. SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xBA52E5FA]
  11. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAssignProcessToJobObject [0xBA47B0E6]
  12. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xBA4BEB36]
  13. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xBA486F18]
  14. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xBA486F64]
  15. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xBA4870FE]
  16. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xBA4BE4EA]
  17. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xBA486E86]
  18. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xBA486FA8]
  19. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xBA486ECE]
  20. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateThread [0xBA47B5E4]
  21. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xBA4870B8]
  22. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDebugActiveProcess [0xBA47BE9C]
  23. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xBA47A676]
  24. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xBA4BF1FC]
  25. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xBA4BF4B2]
  26. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xBA47F596]
  27. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xBA4BF067]
  28. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xBA4BEED2]
  29. SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xBA52E6C2]
  30. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xBA47A25E]
  31. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xBA47A6DC]
  32. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xBA47F98C]
  33. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xBA47C92C]
  34. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xBA486F42]
  35. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xBA486F86]
  36. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xBA487122]
  37. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xBA4BE846]
  38. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xBA486EAC]
  39. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xBA47EE78]
  40. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xBA487036]
  41. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xBA486EF6]
  42. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xBA47F26E]
  43. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xBA4870DC]
  44. SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xBA52E822]
  45. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xBA4BED4D]
  46. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xBA47C7F8]
  47. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xBA4BEB9F]
  48. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueueApcThread [0xBA47C34E]
  49. SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xBA53B744]
  50. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xBA4BDB30]
  51. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xBA47A742]
  52. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xBA47A7A8]
  53. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetContextThread [0xBA47BD16]
  54. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xBA47A2F8]
  55. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xBA47A4CE]
  56. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xBA4BF303]
  57. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xBA47A45C]
  58. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSuspendProcess [0xBA47C066]
  59. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSuspendThread [0xBA47C1C8]
  60. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xBA47A556]
  61. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwTerminateProcess [0xBA47BB54]
  62. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwTerminateThread [0xBA47BCF6]
  63. SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwUnloadDriver [0xBA52CC42]
  64. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xBA47A80E]
  65. SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwWriteVirtualMemory [0xBA47B142]
  66.  
  67. Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xBA547E00]
  68. Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObject
  69. Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject
  70.  
  71. ---- Kernel code sections - GMER 2.1 ----
  72.  
  73. .text ntoskrnl.exe!_abnormal_termination + F0 804E26C4 4 Bytes [EA, E4, 4B, BA]
  74. .text ntoskrnl.exe!_abnormal_termination + 228 804E27FC 8 Bytes CALL EEFAE24C
  75. .text ntoskrnl.exe!_abnormal_termination + 270 804E2844 4 Bytes [22, E8, 52, BA]
  76. .text ntoskrnl.exe!_abnormal_termination + 398 804E296C 12 Bytes [42, A7, 47, BA, A8, A7, 47, ...]
  77. .text ntoskrnl.exe!_abnormal_termination + 440 804E2A14 12 Bytes [66, C0, 47, BA, C8, C1, 47, ...]
  78. PAGE ntoskrnl.exe!ObInsertObject 805651BA 5 Bytes JMP BA5467B4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
  79. PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 8056BC20 4 Bytes CALL BA47CFD9 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  80. PAGE ntoskrnl.exe!ZwCreateProcessEx 805830E4 7 Bytes JMP BA547E04 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
  81. PAGE ntoskrnl.exe!ObMakeTemporaryObject 8059EAEB 5 Bytes JMP BA544C9A \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
  82. .text win32k.sys!EngFreeUserMem + 674 BF80996D 5 Bytes JMP BA481284 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  83. .text win32k.sys!EngFreeUserMem + 35D0 BF80C8C9 5 Bytes JMP BA481162 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  84. .text win32k.sys!EngDeleteSurface + 45 BF813994 5 Bytes JMP BA481116 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  85. .text win32k.sys!BRUSHOBJ_pvAllocRbrush + 322E BF81E641 5 Bytes JMP BA47FBF4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  86. .text win32k.sys!EngMulDiv + 197D BF820D4E 5 Bytes JMP BA4806EC \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  87. .text win32k.sys!EngPaint + 11A6 BF82D568 5 Bytes JMP BA47FD54 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  88. .text win32k.sys!EngLockSurface + C09 BF82E6E6 5 Bytes JMP BA4813FA \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  89. .text win32k.sys!CLIPOBJ_bEnum + 2E84 BF839072 5 Bytes JMP BA481614 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  90. .text win32k.sys!CLIPOBJ_bEnum + B8EC BF841ADA 5 Bytes JMP BA48100A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  91. .text win32k.sys!CLIPOBJ_bEnum + E0A8 BF844296 5 Bytes JMP BA4806CE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  92. .text win32k.sys!CLIPOBJ_bEnum + F624 BF845812 5 Bytes JMP BA47FDF4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  93. .text win32k.sys!XLATEOBJ_iXlate + 290F BF86F4A6 5 Bytes JMP BA4807C4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  94. .text win32k.sys!XLATEOBJ_iXlate + 4BED BF871784 5 Bytes JMP BA48022C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  95. .text win32k.sys!XLATEOBJ_iXlate + 4C78 BF87180F 5 Bytes JMP BA480508 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  96. .text win32k.sys!XLATEOBJ_iXlate + 584E BF8723E5 5 Bytes JMP BA47FAD8 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  97. .text win32k.sys!XLATEOBJ_iXlate + AC2C BF8777C3 5 Bytes JMP BA4811B2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  98. .text win32k.sys!EngUnicodeToMultiByteN + 67EE BF87E9ED 5 Bytes JMP BA48133C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  99. .text win32k.sys!EngGetCurrentCodePage + 35E9 BF897CCE 5 Bytes JMP BA4802F2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  100. .text win32k.sys!EngGetCurrentCodePage + 4126 BF89880B 5 Bytes JMP BA4804C2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  101. .text win32k.sys!EngGetLastError + 1606 BF8B58F7 5 Bytes JMP BA4807E2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  102. .text win32k.sys!EngGradientFill + 2862 BF8B9015 5 Bytes JMP BA48156C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  103. .text win32k.sys!EngAlphaBlend + 35C2 BF8C1B9F 5 Bytes JMP BA47FF24 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  104. .text win32k.sys!EngDeleteSemaphore + A5C1 BF8EB159 2 Bytes JMP BA48070A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  105. .text win32k.sys!EngDeleteSemaphore + A5C4 BF8EB15C 2 Bytes [B9, FA]
  106. .text win32k.sys!PATHOBJ_bCloseFigure + 19EF BF8EFC1A 5 Bytes JMP BA47F9C2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  107. .text win32k.sys!PATHOBJ_bCloseFigure + 3BBE BF8F1DE9 5 Bytes JMP BA480008 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  108. .text win32k.sys!PATHOBJ_bCloseFigure + 3E3E BF8F2069 5 Bytes JMP BA480150 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  109. .text win32k.sys!EngCreateClip + 1A40 BF914A09 5 Bytes JMP BA47FCDC \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  110. .text win32k.sys!EngCreateClip + 1CEC BF914CB5 5 Bytes JMP BA48088C \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  111. .text win32k.sys!EngCreateClip + 2614 BF9155DD 5 Bytes JMP BA47FEBC \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  112. .text win32k.sys!EngCreateClip + 4F95 BF917F5E 5 Bytes JMP BA480628 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  113. .text win32k.sys!EngPlgBlt + 192B BF9484CB 5 Bytes JMP BA4814BE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)
  114.  
  115. ---- User code sections - GMER 2.1 ----
  116.  
  117. .text C:\WINDOWS\explorer.exe[352] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  118. .text C:\WINDOWS\explorer.exe[352] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  119. .text C:\WINDOWS\System32\smss.exe[604] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  120. .text C:\WINDOWS\system32\csrss.exe[676] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  121. .text C:\WINDOWS\system32\csrss.exe[676] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  122. .text C:\WINDOWS\system32\winlogon.exe[704] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  123. .text C:\WINDOWS\system32\winlogon.exe[704] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  124. .text C:\WINDOWS\system32\services.exe[748] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  125. .text C:\WINDOWS\system32\services.exe[748] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  126. .text C:\WINDOWS\system32\lsass.exe[760] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  127. .text C:\WINDOWS\system32\lsass.exe[760] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  128. .text C:\WINDOWS\system32\Ati2evxx.exe[936] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  129. .text C:\WINDOWS\system32\Ati2evxx.exe[936] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  130. .text C:\WINDOWS\system32\svchost.exe[952] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  131. .text C:\WINDOWS\system32\svchost.exe[952] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  132. .text C:\WINDOWS\system32\svchost.exe[1028] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  133. .text C:\WINDOWS\system32\svchost.exe[1028] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  134. .text C:\WINDOWS\System32\svchost.exe[1060] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  135. .text C:\WINDOWS\System32\svchost.exe[1060] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  136. .text C:\WINDOWS\system32\svchost.exe[1136] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  137. .text C:\WINDOWS\system32\svchost.exe[1136] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  138. .text C:\WINDOWS\system32\svchost.exe[1276] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  139. .text C:\WINDOWS\system32\svchost.exe[1276] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  140. .text C:\Program Files\Java\jre7\bin\jqs.exe[1432] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  141. .text C:\Program Files\Java\jre7\bin\jqs.exe[1432] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  142. .text C:\WINDOWS\system32\Ati2evxx.exe[1444] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  143. .text C:\WINDOWS\system32\Ati2evxx.exe[1444] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  144. .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1504] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  145. .text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1504] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  146. .text C:\WINDOWS\system32\spoolsv.exe[1720] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  147. .text C:\WINDOWS\system32\spoolsv.exe[1720] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  148. .text C:\Program Files\AVAST Software\Avast\avastUI.exe[1868] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  149. .text C:\Program Files\AVAST Software\Avast\avastUI.exe[1868] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  150. .text C:\WINDOWS\SOUNDMAN.EXE[1876] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  151. .text C:\WINDOWS\SOUNDMAN.EXE[1876] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  152. .text C:\WINDOWS\system32\svchost.exe[1884] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  153. .text C:\WINDOWS\system32\svchost.exe[1884] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  154. .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[1892] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  155. .text C:\Program Files\Common Files\Java\Java Update\jusched.exe[1892] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  156. .text C:\WINDOWS\system32\ctfmon.exe[1900] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  157. .text C:\WINDOWS\system32\ctfmon.exe[1900] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  158. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 003D01F8
  159. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  160. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ntdll.dll!LdrUnloadDll 7C9171CD 5 Bytes JMP 003D03FC
  161. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  162. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!SetServiceObjectSecurity 77E26D81 5 Bytes JMP 003E1014
  163. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!ChangeServiceConfigA 77E26E69 5 Bytes JMP 003E0804
  164. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!ChangeServiceConfigW 77E27001 5 Bytes JMP 003E0A08
  165. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!ChangeServiceConfig2A 77E27101 5 Bytes JMP 003E0C0C
  166. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!ChangeServiceConfig2W 77E27189 5 Bytes JMP 003E0E10
  167. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!CreateServiceA 77E27211 5 Bytes JMP 003E01F8
  168. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!CreateServiceW 77E273A9 5 Bytes JMP 003E03FC
  169. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] ADVAPI32.dll!DeleteService 77E274B1 5 Bytes JMP 003E0600
  170. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 003F0804
  171. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 003F0A08
  172. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 003F0600
  173. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] USER32.dll!SetWinEventHook 7E3817F7 5 Bytes JMP 003F01F8
  174. .text C:\Program Files\Common Files\Java\Java Update\jucheck.exe[2236] USER32.dll!UnhookWinEvent 7E3818AC 5 Bytes JMP 003F03FC
  175. .text C:\WINDOWS\System32\alg.exe[2396] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  176. .text C:\WINDOWS\System32\alg.exe[2396] kernel32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  177. .text C:\WINDOWS\notepad.exe[2616] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 003201F8
  178. .text C:\WINDOWS\notepad.exe[2616] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  179. .text C:\WINDOWS\notepad.exe[2616] ntdll.dll!LdrUnloadDll 7C9171CD 5 Bytes JMP 003203FC
  180. .text C:\WINDOWS\notepad.exe[2616] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  181. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!SetServiceObjectSecurity 77E26D81 5 Bytes JMP 00331014
  182. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!ChangeServiceConfigA 77E26E69 5 Bytes JMP 00330804
  183. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!ChangeServiceConfigW 77E27001 5 Bytes JMP 00330A08
  184. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!ChangeServiceConfig2A 77E27101 5 Bytes JMP 00330C0C
  185. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!ChangeServiceConfig2W 77E27189 5 Bytes JMP 00330E10
  186. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!CreateServiceA 77E27211 5 Bytes JMP 003301F8
  187. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!CreateServiceW 77E273A9 5 Bytes JMP 003303FC
  188. .text C:\WINDOWS\notepad.exe[2616] ADVAPI32.dll!DeleteService 77E274B1 5 Bytes JMP 00330600
  189. .text C:\WINDOWS\notepad.exe[2616] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 00340804
  190. .text C:\WINDOWS\notepad.exe[2616] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 00340A08
  191. .text C:\WINDOWS\notepad.exe[2616] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00340600
  192. .text C:\WINDOWS\notepad.exe[2616] USER32.dll!SetWinEventHook 7E3817F7 5 Bytes JMP 003401F8
  193. .text C:\WINDOWS\notepad.exe[2616] USER32.dll!UnhookWinEvent 7E3818AC 5 Bytes JMP 003403FC
  194. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 003D01F8
  195. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  196. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ntdll.dll!LdrUnloadDll 7C9171CD 5 Bytes JMP 003D03FC
  197. .text F:\Serwis\Serwis\4c44ns24.exe[3056] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  198. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!SetServiceObjectSecurity 77E26D81 5 Bytes JMP 003F1014
  199. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!ChangeServiceConfigA 77E26E69 5 Bytes JMP 003F0804
  200. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!ChangeServiceConfigW 77E27001 5 Bytes JMP 003F0A08
  201. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!ChangeServiceConfig2A 77E27101 5 Bytes JMP 003F0C0C
  202. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!ChangeServiceConfig2W 77E27189 5 Bytes JMP 003F0E10
  203. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!CreateServiceA 77E27211 5 Bytes JMP 003F01F8
  204. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!CreateServiceW 77E273A9 5 Bytes JMP 003F03FC
  205. .text F:\Serwis\Serwis\4c44ns24.exe[3056] ADVAPI32.dll!DeleteService 77E274B1 5 Bytes JMP 003F0600
  206. .text F:\Serwis\Serwis\4c44ns24.exe[3056] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 004E0804
  207. .text F:\Serwis\Serwis\4c44ns24.exe[3056] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 004E0A08
  208. .text F:\Serwis\Serwis\4c44ns24.exe[3056] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 004E0600
  209. .text F:\Serwis\Serwis\4c44ns24.exe[3056] USER32.dll!SetWinEventHook 7E3817F7 5 Bytes JMP 004E01F8
  210. .text F:\Serwis\Serwis\4c44ns24.exe[3056] USER32.dll!UnhookWinEvent 7E3818AC 5 Bytes JMP 004E03FC
  211. .text C:\WINDOWS\system32\wuauclt.exe[3272] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 003201F8
  212. .text C:\WINDOWS\system32\wuauclt.exe[3272] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  213. .text C:\WINDOWS\system32\wuauclt.exe[3272] ntdll.dll!LdrUnloadDll 7C9171CD 5 Bytes JMP 003203FC
  214. .text C:\WINDOWS\system32\wuauclt.exe[3272] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  215. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!SetServiceObjectSecurity 77E26D81 5 Bytes JMP 00331014
  216. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!ChangeServiceConfigA 77E26E69 5 Bytes JMP 00330804
  217. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!ChangeServiceConfigW 77E27001 5 Bytes JMP 00330A08
  218. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!ChangeServiceConfig2A 77E27101 5 Bytes JMP 00330C0C
  219. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!ChangeServiceConfig2W 77E27189 5 Bytes JMP 00330E10
  220. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!CreateServiceA 77E27211 5 Bytes JMP 003301F8
  221. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!CreateServiceW 77E273A9 5 Bytes JMP 003303FC
  222. .text C:\WINDOWS\system32\wuauclt.exe[3272] ADVAPI32.dll!DeleteService 77E274B1 5 Bytes JMP 00330600
  223. .text C:\WINDOWS\system32\wuauclt.exe[3272] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 00340804
  224. .text C:\WINDOWS\system32\wuauclt.exe[3272] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 00340A08
  225. .text C:\WINDOWS\system32\wuauclt.exe[3272] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00340600
  226. .text C:\WINDOWS\system32\wuauclt.exe[3272] USER32.dll!SetWinEventHook 7E3817F7 5 Bytes JMP 003401F8
  227. .text C:\WINDOWS\system32\wuauclt.exe[3272] USER32.dll!UnhookWinEvent 7E3818AC 5 Bytes JMP 003403FC
  228. .text C:\WINDOWS\System32\svchost.exe[3824] ntdll.dll!LdrLoadDll 7C91632D 5 Bytes JMP 003101F8
  229. .text C:\WINDOWS\System32\svchost.exe[3824] ntdll.dll!RtlDosSearchPath_U + 186 7C916865 1 Byte [62]
  230. .text C:\WINDOWS\System32\svchost.exe[3824] ntdll.dll!LdrUnloadDll 7C9171CD 5 Bytes JMP 003103FC
  231. .text C:\WINDOWS\System32\svchost.exe[3824] KERNEL32.dll!GetBinaryTypeW + 80 7C868E04 1 Byte [62]
  232. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!SetServiceObjectSecurity 77E26D81 5 Bytes JMP 00321014
  233. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!ChangeServiceConfigA 77E26E69 5 Bytes JMP 00320804
  234. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!ChangeServiceConfigW 77E27001 5 Bytes JMP 00320A08
  235. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!ChangeServiceConfig2A 77E27101 5 Bytes JMP 00320C0C
  236. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!ChangeServiceConfig2W 77E27189 5 Bytes JMP 00320E10
  237. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!CreateServiceA 77E27211 5 Bytes JMP 003201F8
  238. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!CreateServiceW 77E273A9 5 Bytes JMP 003203FC
  239. .text C:\WINDOWS\System32\svchost.exe[3824] ADVAPI32.dll!DeleteService 77E274B1 5 Bytes JMP 00320600
  240. .text C:\WINDOWS\System32\svchost.exe[3824] USER32.dll!SetWindowsHookExW 7E37820F 5 Bytes JMP 00470804
  241. .text C:\WINDOWS\System32\svchost.exe[3824] USER32.dll!UnhookWindowsHookEx 7E37D5F3 5 Bytes JMP 00470A08
  242. .text C:\WINDOWS\System32\svchost.exe[3824] USER32.dll!SetWindowsHookExA 7E381211 5 Bytes JMP 00470600
  243. .text C:\WINDOWS\System32\svchost.exe[3824] USER32.dll!SetWinEventHook 7E3817F7 5 Bytes JMP 004701F8
  244. .text C:\WINDOWS\System32\svchost.exe[3824] USER32.dll!UnhookWinEvent 7E3818AC 5 Bytes JMP 004703FC
  245.  
  246. ---- User IAT/EAT - GMER 2.1 ----
  247.  
  248. IAT C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 003E0002
  249. IAT C:\WINDOWS\system32\services.exe[748] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 003E0000
  250. IAT C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1504] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [64C90790] C:\Program Files\AVAST Software\Avast\aswCmnBS.dll (Common functions/AVAST Software)
  251. IAT C:\Program Files\AVAST Software\Avast\avastUI.exe[1868] @ C:\WINDOWS\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [64C90790] C:\Program Files\AVAST Software\Avast\aswCmnBS.dll (Common functions/AVAST Software)
  252.  
  253. ---- Devices - GMER 2.1 ----
  254.  
  255. Device \FileSystem\Ntfs \Ntfs aswSP.SYS (avast! self protection module/AVAST Software)
  256.  
  257. AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
  258. AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
  259. AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
  260. AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.SYS (avast! TDI Filter Driver/AVAST Software)
  261. AttachedDevice \FileSystem\Fastfat \Fat fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
  262.  
  263. ---- EOF - GMER 2.1 ----
Advertisement
Add Comment
Please, Sign In to add comment
Advertisement
Public Pastes
Advertisement
We use cookies for various purposes including analytics. By continuing to use Pastebin, you agree to our use of cookies as described in the Cookies Policy.  OK, I Understand
Not a member of Pastebin yet?
Sign Up, it unlocks many cool features!