GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-05-26 16:36:50 Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD1200JB-00GVC0 rev.08.02D08 Running: 1ybg2y0n.exe; Driver: C:\Users\adam\AppData\Local\Temp\aftcqaow.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 140D 82C923C9 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82CCBD52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- User code sections - GMER 1.0.15 ---- .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtCreateFile + 6 774E55CE 4 Bytes [28, 00, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtCreateFile + B 774E55D3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 1 Byte [28] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 4 Bytes [28, 03, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtMapViewOfSection + B 774E5C33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenFile + 6 774E5CDE 4 Bytes [68, 00, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenFile + B 774E5CE3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenProcess + 6 774E5D8E 4 Bytes [A8, 01, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenProcess + B 774E5D93 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenProcessToken + B 774E5DA3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenProcessTokenEx + 6 774E5DAE 4 Bytes [A8, 02, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenProcessTokenEx + B 774E5DB3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenThread + 6 774E5E0E 4 Bytes [68, 01, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenThread + B 774E5E13 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenThreadToken + 6 774E5E1E 4 Bytes [68, 02, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenThreadToken + B 774E5E23 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtOpenThreadTokenEx + B 774E5E33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtQueryAttributesFile + 6 774E5F3E 4 Bytes [A8, 00, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtQueryAttributesFile + B 774E5F43 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtQueryFullAttributesFile + B 774E5FF3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtSetInformationFile + 6 774E663E 4 Bytes [28, 01, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtSetInformationFile + B 774E6643 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtSetInformationThread + 6 774E669E 4 Bytes [28, 02, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtSetInformationThread + B 774E66A3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 1 Byte [68] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 4 Bytes [68, 03, 47, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[1428] ntdll.dll!NtUnmapViewOfSection + B 774E69C3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtCreateFile + 6 774E55CE 4 Bytes [28, 00, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtCreateFile + B 774E55D3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 1 Byte [28] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 4 Bytes [28, 03, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtMapViewOfSection + B 774E5C33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenFile + 6 774E5CDE 4 Bytes [68, 00, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenFile + B 774E5CE3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenProcess + 6 774E5D8E 4 Bytes [A8, 01, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenProcess + B 774E5D93 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenProcessToken + B 774E5DA3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenProcessTokenEx + 6 774E5DAE 4 Bytes [A8, 02, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenProcessTokenEx + B 774E5DB3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenThread + 6 774E5E0E 4 Bytes [68, 01, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenThread + B 774E5E13 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenThreadToken + 6 774E5E1E 4 Bytes [68, 02, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenThreadToken + B 774E5E23 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtOpenThreadTokenEx + B 774E5E33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtQueryAttributesFile + 6 774E5F3E 4 Bytes [A8, 00, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtQueryAttributesFile + B 774E5F43 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtQueryFullAttributesFile + B 774E5FF3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtSetInformationFile + 6 774E663E 4 Bytes [28, 01, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtSetInformationFile + B 774E6643 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtSetInformationThread + 6 774E669E 4 Bytes [28, 02, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtSetInformationThread + B 774E66A3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 1 Byte [68] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 4 Bytes [68, 03, 37, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2520] ntdll.dll!NtUnmapViewOfSection + B 774E69C3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtCreateFile + 6 774E55CE 4 Bytes [28, 00, 0A, 00] {SUB [EAX], AL; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtCreateFile + B 774E55D3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 1 Byte [28] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtMapViewOfSection + 6 774E5C2E 4 Bytes [28, 03, 0A, 00] {SUB [EBX], AL; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtMapViewOfSection + B 774E5C33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenFile + 6 774E5CDE 4 Bytes [68, 00, 0A, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenFile + B 774E5CE3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenProcess + 6 774E5D8E 4 Bytes [A8, 01, 0A, 00] {TEST AL, 0x1; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenProcess + B 774E5D93 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenProcessToken + B 774E5DA3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenProcessTokenEx + 6 774E5DAE 4 Bytes [A8, 02, 0A, 00] {TEST AL, 0x2; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenProcessTokenEx + B 774E5DB3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenThread + 6 774E5E0E 4 Bytes [68, 01, 0A, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenThread + B 774E5E13 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenThreadToken + 6 774E5E1E 4 Bytes [68, 02, 0A, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenThreadToken + B 774E5E23 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtOpenThreadTokenEx + B 774E5E33 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtQueryAttributesFile + 6 774E5F3E 4 Bytes [A8, 00, 0A, 00] {TEST AL, 0x0; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtQueryAttributesFile + B 774E5F43 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtQueryFullAttributesFile + B 774E5FF3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtSetInformationFile + 6 774E663E 4 Bytes [28, 01, 0A, 00] {SUB [ECX], AL; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtSetInformationFile + B 774E6643 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtSetInformationThread + 6 774E669E 4 Bytes [28, 02, 0A, 00] {SUB [EDX], AL; OR AL, [EAX]} .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtSetInformationThread + B 774E66A3 1 Byte [E2] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 1 Byte [68] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtUnmapViewOfSection + 6 774E69BE 4 Bytes [68, 03, 0A, 00] .text C:\Users\adam\AppData\Local\Google\Chrome\Application\chrome.exe[2620] ntdll.dll!NtUnmapViewOfSection + B 774E69C3 1 Byte [E2] ---- Devices - GMER 1.0.15 ---- Device \Driver\ACPI_HAL \Device\00000044 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) ---- Files - GMER 1.0.15 ---- File C:\Windows\$NtUninstallKB28605$\3258299621 0 bytes File C:\Windows\$NtUninstallKB28605$\3403064683 0 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\@ 2048 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\cfg.ini 204 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\Desktop.ini 4608 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\L 0 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\L\xadqgnnk 187904 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\twl.dll 223744 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U 0 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\00000001.@ 2048 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\00000002.@ 224768 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\00000004.@ 1024 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\80000000.@ 66560 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\80000004.@ 1024 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\U\80000032.@ 115712 bytes File C:\Windows\$NtUninstallKB28605$\3403064683\version 1275 bytes ---- EOF - GMER 1.0.15 ----