GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-05-01 12:11:12 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK2561GSYN rev.MH000C 232,89GB Running: 4b5fop57.exe; Driver: C:\Users\user\AppData\Local\Temp\aftcaaob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe[2796] C:\Windows\system32\kernel32.dll!LoadLibraryW 0000000076ef6420 5 bytes JMP 00000001728ef140 .text C:\Program Files\Common Files\McAfee\Platform\McSvcHost\McSvHost.exe[2796] C:\Windows\system32\kernel32.dll!LoadLibraryA 0000000076ef6510 5 bytes JMP 00000001728ef020 .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\0780f478-67ce-4ec3-98db-39a65f4618ce\plugins\3\plugin.exe[4904] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 00000000766f7d20 5 bytes JMP 000000016d0ed820 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007674ccd0 5 bytes JMP 000000016d0ed7d0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW 0000000076751400 5 bytes JMP 000000016d0ed3f0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\WININET.dll!InternetConnectW 00000000767552a0 5 bytes JMP 000000016d0ed160 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007675e070 5 bytes JMP 000000016d0ed770 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[5092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[2880] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 00000000766f7d20 5 bytes JMP 000000016d0ed820 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007674ccd0 5 bytes JMP 000000016d0ed7d0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW 0000000076751400 5 bytes JMP 000000016d0ed3f0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\WININET.dll!InternetConnectW 00000000767552a0 5 bytes JMP 000000016d0ed160 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007675e070 5 bytes JMP 000000016d0ed770 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 00000000766f7d20 5 bytes JMP 000000016d0ed820 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007674ccd0 5 bytes JMP 000000016d0ed7d0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW 0000000076751400 5 bytes JMP 000000016d0ed3f0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\WININET.dll!InternetConnectW 00000000767552a0 5 bytes JMP 000000016d0ed160 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007675e070 5 bytes JMP 000000016d0ed770 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\WININET.dll!InternetQueryDataAvailable 00000000766f7d20 5 bytes JMP 000000016d0ed820 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\WININET.dll!InternetCloseHandle 000000007674ccd0 5 bytes JMP 000000016d0ed7d0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\WININET.dll!HttpOpenRequestW 0000000076751400 5 bytes JMP 000000016d0ed3f0 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\WININET.dll!InternetConnectW 00000000767552a0 5 bytes JMP 000000016d0ed160 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\WININET.dll!InternetReadFile 000000007675e070 5 bytes JMP 000000016d0ed770 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075ea1401 2 bytes JMP 769cb1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075ea1419 2 bytes JMP 769cb31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075ea1431 2 bytes JMP 76a48f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075ea144a 2 bytes CALL 769a4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075ea14dd 2 bytes JMP 76a48802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075ea14f5 2 bytes JMP 76a489d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075ea150d 2 bytes JMP 76a486f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075ea1525 2 bytes JMP 76a48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075ea153d 2 bytes JMP 769bfc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075ea1555 2 bytes JMP 769c68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075ea156d 2 bytes JMP 76a48fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075ea1585 2 bytes JMP 76a48b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075ea159d 2 bytes JMP 76a486bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075ea15b5 2 bytes JMP 769bfd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075ea15cd 2 bytes JMP 769cb2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075ea16b2 2 bytes JMP 76a48e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3508] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075ea16bd 2 bytes JMP 76a48651 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\mfevtps.exe[2068] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!LoadLibraryA] [13f3ebbb0] C:\Windows\system32\mfevtps.exe IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Program Files\Internet Explorer\iexplore.exe[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\USER32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\GDI32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\advapi32.DLL[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\shell32.DLL[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\shell32.DLL[USER32.dll!MessageBoxIndirectW] [7fef3f7d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\shell32.DLL[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SHLWAPI.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!DialogBoxParamA] [7fef3fa63a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SHLWAPI.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\iertutil.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\version.DLL[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IMM32.DLL[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\MSCTF.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEFRAME.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEFRAME.dll[USER32.dll!MessageBoxIndirectW] [7fef3f7d840] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ole32.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ole32.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ole32.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\OLEAUT32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\OLEAUT32.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef3fa62c0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac\comctl32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\comdlg32.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\comdlg32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef3fa62c0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\comdlg32.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\comdlg32.dll[COMCTL32.dll!PropertySheetW] [7fef3fa7120] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\comdlg32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\uxtheme.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\urlmon.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\urlmon.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\urlmon.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\WININET.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\dwmapi.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\Secur32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\CLBCatQ.DLL[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\CLBCatQ.DLL[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\netprofm.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\nlaapi.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\rsaenh.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Program Files\Internet Explorer\ieproxy.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\fwpuclnt.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\apphelp.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\CRYPT32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IEUI.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\PROPSYS.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\windowscodecs.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\oleacc.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\explorerframe.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\explorerframe.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\DUser.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\DUI70.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\DUI70.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\MLANG.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SETUPAPI.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SETUPAPI.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\CFGMGR32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ntmarta.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\WLDAP32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\dxgi.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\WINTRUST.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\NaturalLanguage6.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\tquery.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\StructuredQuery.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\bcrypt.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\cryptnet.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\credssp.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\schannel.DLL[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\LINKINFO.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ntshrui.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ntshrui.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\ntshrui.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\srvcli.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\ieapfltr.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\msxml6.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\shdocvw.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\shdocvw.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\shdocvw.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\MPR.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\EhStorShell.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\COMCTL32.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\COMCTL32.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\WinSxS\amd64_microsoft.windows.common-controls_6595b64144ccf1df_5.82.7601.18201_none_a4d3b9377117c3df\COMCTL32.dll[USER32.dll!DialogBoxIndirectParamW] [7fef3fa62c0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\cscui.dll[USER32.dll!EnableWindow] [7fef3f63370] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\cscui.dll[USER32.dll!DialogBoxParamW] [7fef3fa64a0] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\cscui.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\CSCDLL.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\actxprxy.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Program Files\Common Files\microsoft shared\ink\tiptsf.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\thumbcache.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\NetworkExplorer.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\WINSTA.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\DAVHLPR.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\wkscli.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\WINMM.dll[USER32.dll!MessageBoxW] [7fef3fa6a30] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\WINMM.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\System32\NLSData0000.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\mscms.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\IconCodecService.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\SearchFolder.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\PortableDeviceApi.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll IAT C:\Program Files\Internet Explorer\iexplore.exe[3696] @ C:\Windows\system32\EhStorAPI.dll[KERNEL32.dll!GetProcAddress] [7fef3f61800] C:\Program Files\Internet Explorer\IEShims.dll ---- Processes - GMER 2.1 ---- Library C:\Users\user\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [1804] (GG drive menu/GG Network S.A.)(2014- 000000005ff80000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af007fce Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af007fd2 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af007fce (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af007fd2 (not active ControlSet) ---- EOF - GMER 2.1 ----