GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-05-01 12:27:31 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST1000LM rev.2AR1 931,51GB Running: junceqt0.exe; Driver: C:\Users\Juleczka\AppData\Local\Temp\pwdyrkow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000074e28769 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1544] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2272] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe[2500] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2620] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000762f2ab1 5 bytes JMP 0000000100f82ac0 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[1408] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe[5588] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076911401 2 bytes JMP 74e4b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076911419 2 bytes JMP 74e4b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076911431 2 bytes JMP 74ec8f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007691144a 2 bytes CALL 74e24885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000769114dd 2 bytes JMP 74ec8802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000769114f5 2 bytes JMP 74ec89d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007691150d 2 bytes JMP 74ec86f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076911525 2 bytes JMP 74ec8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007691153d 2 bytes JMP 74e3fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076911555 2 bytes JMP 74e468bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007691156d 2 bytes JMP 74ec8fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076911585 2 bytes JMP 74ec8b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007691159d 2 bytes JMP 74ec86bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000769115b5 2 bytes JMP 74e3fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000769115cd 2 bytes JMP 74e4b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000769116b2 2 bytes JMP 74ec8e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[6520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000769116bd 2 bytes JMP 74ec8651 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msiexec.exe[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msiexec.exe[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ADVAPI32.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!SetFileSecurityW] [7fef424bcb0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExA] [7fef424ba0c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegDeleteKeyW] [7fef424d12c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\msi.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHELL32.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!SetFileAttributesA] [7fef424ab7c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!CreateFileA] [7fef424a2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSPOOL.DRV[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\sfc_os.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!PrivCopyFileExW] [7fef424ab04] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\USERENV.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!OpenFile] [7fef424a890] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!_lcreat] [7fef424a9a0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!_lopen] [7fef424a924] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!_lwrite] [7fef424aa1c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!DeleteFileA] [7fef424a580] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VERSION.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\COMCTL32.DLL[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\COMCTL32.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!_lwrite] [7fef424aa1c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!CreateFileA] [7fef424a2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegCreateKeyExA] [7fef424b3dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!RegSetValueExA] [7fef424ba0c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SRCLIENT.DLL[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SPP.dll[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VSSAPI.DLL[KERNEL32.dll!CopyFileExW] [7fef424a260] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ATL.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ATL.DLL[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\VssTrace.DLL[KERNEL32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\ncrypt.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileA] [7fef424a2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CFGMGR32.dll[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\DEVRTL.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSTA.DLL[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\WINSTA.DLL[KERNEL32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!MoveFileW] [7fef424a6e0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!CopyFileW] [7fef424a184] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!CreateFileA] [7fef424a2d8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!DeleteFileA] [7fef424a580] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!SetFileAttributesA] [7fef424ab7c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!CopyFileA] [7fef424a120] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegDeleteValueA] [7fef424bb44] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegSetValueExA] [7fef424ba0c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegOpenKeyExA] [7fef424b60c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegCreateKeyExA] [7fef424b3dc] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegDeleteValueW] [7fef424bbc8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegSetValueExW] [7fef424baa8] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegCreateKeyExW] [7fef424b4f4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\Microsoft.NET\Framework64\v4.0.30319\clr.dll[ADVAPI32.dll!RegOpenKeyExW] [7fef424b6d0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSVCR120_CLR0400.dll[KERNEL32.dll!GetProcAddress] [7fefcca4230] C:\Windows\system32\apphelp.dll IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSVCR120_CLR0400.dll[KERNEL32.dll!SetFileAttributesW] [7fef424abe0] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSVCR120_CLR0400.dll[KERNEL32.dll!MoveFileExW] [7fef424a804] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSVCR120_CLR0400.dll[KERNEL32.dll!DeleteFileW] [7fef424a5e4] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL IAT C:\Windows\system32\msiexec.exe[6668] @ C:\Windows\system32\MSVCR120_CLR0400.dll[KERNEL32.dll!CreateFileW] [7fef424a42c] C:\Windows\AppPatch\AppPatch64\AcGenral.DLL ---- Threads - GMER 2.1 ---- Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:5692] 0000000076857587 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:4608] 0000000071d18aa6 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:3868] 00000000772513b5 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:2252] 00000000772627e5 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:4944] 00000000772627e5 Thread C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [6932:4432] 00000000772627e5 ---- Processes - GMER 2.1 ---- Process C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe (*** suspicious ***) @ C:\ProgramData\Samsung\SW Update Service\SWMAgent.exe [5588] (SW Update Agent/Samsung Electronics CO., LTD.)(2013-10-21 20:07:30) 00000000002c0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c48508131711 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c48508131711 (not active ControlSet) ---- EOF - GMER 2.1 ----