pot1234Dreadlox
Posts: 106 +0
Broni Hi, had a virus (malware) on another computer. - not sure if this is infected also. Logs posted below. Tanks for your help last time, DL.
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.15.02
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
AEB :: FM-NETBOOK [administrator]
Protection: Enabled
15/06/2012 12:42:31
mbam-log-2012-06-15 (12-42-31).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 227909
Time elapsed: 14 minute(s), 47 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
GMER log part 1
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-06-15 14:51:23
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.11.0
Running: pu82zy4i.exe; Driver: C:\DOCUME~1\AEB\LOCALS~1\Temp\uxtyiaod.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwAdjustPrivilegesToken [0xA9BFC86C]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwCreateKey [0xA9BFA9BC]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwCreateSymbolicLinkObject [0xA9BFCB30]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwMakeTemporaryObject [0xA9BFCD1D]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenKey [0xA9BFA920]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenProcess [0xA9BFBA29]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenSection [0xA9BFCA3B]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenThread [0xA9BFBA7A]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwRequestWaitReplyPort [0xA9BFBFA5]
SSDT \SystemRoot\System32\DRIVERS\kmxagent.sys (TM Engine Agent Driver/CA) ZwSetInformationProcess [0xF59EA702]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwSetSecurityObject [0xA9BFCBF6]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwSetSystemInformation [0xA9BFCC87]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6E C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessW + 2 7C802338 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessA + 2 7C80236D 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!GetProcAddress + 2 7C80AE42 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59A C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!FreeLibrary 7C80AC7E 5 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 5 Bytes JMP 5FF4E59C C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 7C802336 7 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 7C80236B 7 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!FreeLibrary 7C80AC7E 6 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 8 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 8 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59B C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessW 7C802336 7 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessA 7C80236B 7 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!FreeLibrary 7C80AC7E 6 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 8 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 8 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59B C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoCreateInstanceEx + 2 774FF166 8 Bytes JMP 5FF4D28F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoInitializeEx + 2 77501485 8 Bytes JMP 5FF4D133 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetClassObject + 2 77515207 8 Bytes JMP 5FF4D3EB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetInstanceFromFile + 2 77540234 8 Bytes JMP 5FF4D547 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetInstanceFromIStorage + 2 77596B37 8 Bytes JMP 5FF4D6A3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!FreeLibrary 7C80AC7E 5 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 5 Bytes JMP 5FF4E59C C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoCreateInstanceEx 774FF164 5 Bytes JMP 5FF4D290 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoInitializeEx 77501483 5 Bytes JMP 5FF4D134 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetClassObject 77515205 5 Bytes JMP 5FF4D3EC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetInstanceFromFile 77540232 5 Bytes JMP 5FF4D548 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetInstanceFromIStorage 77596B35 5 Bytes JMP 5FF4D6A4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoCreateInstanceEx 774FF164 5 Bytes JMP 5FF4D290 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoInitializeEx 77501483 5 Bytes JMP 5FF4D134 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetClassObject 77515205 5 Bytes JMP 5FF4D3EC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetInstanceFromFile 77540232 5 Bytes JMP 5FF4D548 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetInstanceFromIStorage 77596B35 5 Bytes JMP 5FF4D6A4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoCreateInstanceEx + 2 774FF166 8 Bytes JMP 5FF4D28F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoInitializeEx + 2 77501485 8 Bytes JMP 5FF4D133 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetClassObject + 2 77515207 8 Bytes JMP 5FF4D3EB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetInstanceFromFile + 2 77540234 8 Bytes JMP 5FF4D547 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetInstanceFromIStorage + 2 77596B37 8 Bytes JMP 5FF4D6A3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMCoSendComplete] 85E87F10
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMSetAttributesEx] 85ACEF50
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisInitializeWrapper] 85AC9C60
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMRegisterMiniport] 85AC3118
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisTerminateWrapper] 85CF22D8
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AD1888
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisClOpenAddressFamily] 85DABC10
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] 85AD1EC0
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] 85ED6D18
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMCoSendComplete] 85ED7EC8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMSetAttributesEx] 85E9C390
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AD5400
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisReturnPackets] 86F63938
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisInitializeWrapper] 85DAFAA8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisTerminateWrapper] 85AD98A0
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 86F60D88
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMRegisterMiniport] 85ADB008
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 85DA1B40
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] 85DD1398
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisReturnPackets] 85EDBDA8
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] 85AD5560
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMSetAttributesEx] 85DA4650
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisTerminateWrapper] 85AD4C98
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMRegisterMiniport] 85AD3A80
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisInitializeWrapper] 85DAF458
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMSetAttributesEx] 85DD7908
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisInitializeWrapper] 85D12050
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMRegisterMiniport] 85EDE9B8
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisTerminateWrapper] 85D86E28
IAT \SystemRoot\system32\DRIVERS\TDI.SYS[NDIS.SYS!NdisReturnPackets] 85D67F60
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisReturnPackets] 85AEE4B0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisTerminateWrapper] 85ADB378
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisIMAssociateMiniport] 85AF1EF8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisIMRegisterLayeredMiniport] 85DCE0E0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 85EE7AE0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisInitializeWrapper] 85E2B180
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] 85ADA778
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisClOpenAddressFamily] 85DAAA38
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisMSetAttributesEx] 85AABDF0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] 85AE04B0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisInitializeWrapper] 85AD0CE0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMCoSendComplete] 85AD8AE8
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMSetAttributesEx] 85AD09B0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AE2C20
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMRegisterMiniport] 85ACB428
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisTerminateWrapper] 85AD8810
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 857EB7C8
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] 85C6EAE0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] 85D6ABA0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCmRegisterAddressFamily] 85E037A0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisClOpenAddressFamily] 857EB700
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] 85C55B58
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] 85E4FDB0
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 85C609D0
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisReturnPackets] 85C69220
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisReturnPackets] 85250F60
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 8587F618
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] 85DBA138
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] 852400F0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisReturnPackets] FF065240
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] FEE54120
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] FF0905A0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] 85ADC9D8
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMRegisterMiniport] FEF3D4D8
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisTerminateWrapper] 853B8508
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMSetAttributesEx] FC73C330
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisInitializeWrapper] FC75C938
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)
Malwarebytes Anti-Malware (Trial) 1.61.0.1400
www.malwarebytes.org
Database version: v2012.06.15.02
Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18702
AEB :: FM-NETBOOK [administrator]
Protection: Enabled
15/06/2012 12:42:31
mbam-log-2012-06-15 (12-42-31).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 227909
Time elapsed: 14 minute(s), 47 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
GMER log part 1
GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-06-15 14:51:23
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD16 rev.11.0
Running: pu82zy4i.exe; Driver: C:\DOCUME~1\AEB\LOCALS~1\Temp\uxtyiaod.sys
---- System - GMER 1.0.15 ----
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwAdjustPrivilegesToken [0xA9BFC86C]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwCreateKey [0xA9BFA9BC]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwCreateSymbolicLinkObject [0xA9BFCB30]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwMakeTemporaryObject [0xA9BFCD1D]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenKey [0xA9BFA920]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenProcess [0xA9BFBA29]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenSection [0xA9BFCA3B]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwOpenThread [0xA9BFBA7A]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwRequestWaitReplyPort [0xA9BFBFA5]
SSDT \SystemRoot\System32\DRIVERS\kmxagent.sys (TM Engine Agent Driver/CA) ZwSetInformationProcess [0xF59EA702]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwSetSecurityObject [0xA9BFCBF6]
SSDT \SystemRoot\System32\DRIVERS\KmxSbx.sys (HIPS Registry, Spawning and Devices Guard driver/CA) ZwSetSystemInformation [0xA9BFCC87]
---- User code sections - GMER 1.0.15 ----
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6E C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessW + 2 7C802338 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!CreateProcessA + 2 7C80236D 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] kernel32.dll!GetProcAddress + 2 7C80AE42 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59A C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[176] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!FreeLibrary 7C80AC7E 5 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 5 Bytes JMP 5FF4E59C C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1156] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\System32\alg.exe[1256] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessW 7C802336 7 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!CreateProcessA 7C80236B 7 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!FreeLibrary 7C80AC7E 6 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 8 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 8 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59B C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1436] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD6F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessW 7C802336 7 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!CreateProcessA 7C80236B 7 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!FreeLibrary 7C80AC7E 6 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] kernel32.dll!GetProcAddress 7C80AE40 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 8 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 8 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E59B C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\svchost.exe[1520] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] SHELL32.dll!SHCreateProcessAsUserW + 2 7CAC94D6 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoCreateInstanceEx + 2 774FF166 8 Bytes JMP 5FF4D28F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoInitializeEx + 2 77501485 8 Bytes JMP 5FF4D133 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetClassObject + 2 77515207 8 Bytes JMP 5FF4D3EB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetInstanceFromFile + 2 77540234 8 Bytes JMP 5FF4D547 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\PLFSetI.exe[3340] ole32.dll!CoGetInstanceFromIStorage + 2 77596B37 8 Bytes JMP 5FF4D6A3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!CreateProcessW 7C802336 5 Bytes JMP 5FF4E440 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!CreateProcessA 7C80236B 5 Bytes JMP 5FF4E2E4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!FreeLibrary 7C80AC7E 5 Bytes JMP 5FF4E028 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessAsUserW 77DEA8A9 5 Bytes JMP 5FF4E6F8 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessAsUserA 77E10CE8 5 Bytes JMP 5FF4E854 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 5 Bytes JMP 5FF4E59C C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoCreateInstanceEx 774FF164 5 Bytes JMP 5FF4D290 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoInitializeEx 77501483 5 Bytes JMP 5FF4D134 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetClassObject 77515205 5 Bytes JMP 5FF4D3EC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetInstanceFromFile 77540232 5 Bytes JMP 5FF4D548 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] ole32.dll!CoGetInstanceFromIStorage 77596B35 5 Bytes JMP 5FF4D6A4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\WINDOWS\system32\ctfmon.exe[3488] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 6 Bytes JMP 5FF4E9AF C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!LoadLibraryExW 7C801AF5 7 Bytes JMP 5FF4DD70 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] kernel32.dll!GetProcAddress 7C80AE40 5 Bytes JMP 5FF4DECC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] SHELL32.dll!SHCreateProcessAsUserW 7CAC94D4 5 Bytes JMP 5FF4E9B0 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoCreateInstanceEx 774FF164 5 Bytes JMP 5FF4D290 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoInitializeEx 77501483 5 Bytes JMP 5FF4D134 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetClassObject 77515205 5 Bytes JMP 5FF4D3EC C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetInstanceFromFile 77540232 5 Bytes JMP 5FF4D548 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text C:\Documents and Settings\AEB\Optus\Remote Diagnostics\cpmmgrd.exe[3756] ole32.dll!CoGetInstanceFromIStorage 77596B35 5 Bytes JMP 5FF4D6A4 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!LoadLibraryExW 7C801AF5 12 Bytes JMP 5FF4DD6D C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!CreateProcessW + 2 7C802338 8 Bytes JMP 5FF4E43F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!CreateProcessA + 2 7C80236D 8 Bytes JMP 5FF4E2E3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!FreeLibrary + 2 7C80AC80 7 Bytes JMP 5FF4E027 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] kernel32.dll!GetProcAddress + 2 7C80AE42 6 Bytes JMP 5FF4DECB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessAsUserW + 2 77DEA8AB 6 Bytes JMP 5FF4E6F7 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessAsUserA + 2 77E10CEA 6 Bytes JMP 5FF4E853 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ADVAPI32.dll!CreateProcessWithLogonW 77E15FFD 10 Bytes JMP 5FF4E599 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoCreateInstanceEx + 2 774FF166 8 Bytes JMP 5FF4D28F C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoInitializeEx + 2 77501485 8 Bytes JMP 5FF4D133 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetClassObject + 2 77515207 8 Bytes JMP 5FF4D3EB C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetInstanceFromFile + 2 77540234 8 Bytes JMP 5FF4D547 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
.text D:\MALWARE - progs to get rid of\gmer\pu82zy4i.exe[3852] ole32.dll!CoGetInstanceFromIStorage + 2 77596B37 8 Bytes JMP 5FF4D6A3 C:\WINDOWS\system32\UmxSbxw.dll (User mode executive module DLL/CA)
---- Kernel IAT/EAT - GMER 1.0.15 ----
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMCoSendComplete] 85E87F10
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMSetAttributesEx] 85ACEF50
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisInitializeWrapper] 85AC9C60
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMRegisterMiniport] 85AC3118
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisTerminateWrapper] 85CF22D8
IAT \SystemRoot\system32\DRIVERS\rasl2tp.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AD1888
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisClOpenAddressFamily] 85DABC10
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisCloseAdapter] 85AD1EC0
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] 85ED6D18
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMCoSendComplete] 85ED7EC8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMSetAttributesEx] 85E9C390
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AD5400
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisReturnPackets] 86F63938
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisInitializeWrapper] 85DAFAA8
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisTerminateWrapper] 85AD98A0
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisRegisterProtocol] 86F60D88
IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisMRegisterMiniport] 85ADB008
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisRegisterProtocol] 85DA1B40
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] 85DD1398
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisReturnPackets] 85EDBDA8
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisCloseAdapter] 85AD5560
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMSetAttributesEx] 85DA4650
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisTerminateWrapper] 85AD4C98
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisMRegisterMiniport] 85AD3A80
IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisInitializeWrapper] 85DAF458
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMSetAttributesEx] 85DD7908
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisInitializeWrapper] 85D12050
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisMRegisterMiniport] 85EDE9B8
IAT \SystemRoot\system32\DRIVERS\raspptp.sys[NDIS.SYS!NdisTerminateWrapper] 85D86E28
IAT \SystemRoot\system32\DRIVERS\TDI.SYS[NDIS.SYS!NdisReturnPackets] 85D67F60
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisReturnPackets] 85AEE4B0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisTerminateWrapper] 85ADB378
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisIMAssociateMiniport] 85AF1EF8
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisIMRegisterLayeredMiniport] 85DCE0E0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisRegisterProtocol] 85EE7AE0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisInitializeWrapper] 85E2B180
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] 85ADA778
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisClOpenAddressFamily] 85DAAA38
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisMSetAttributesEx] 85AABDF0
IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisCloseAdapter] 85AE04B0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisInitializeWrapper] 85AD0CE0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMCoSendComplete] 85AD8AE8
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMSetAttributesEx] 85AD09B0
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMCmRegisterAddressFamily] 85AE2C20
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisMRegisterMiniport] 85ACB428
IAT \SystemRoot\system32\DRIVERS\raspti.sys[NDIS.SYS!NdisTerminateWrapper] 85AD8810
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisRegisterProtocol] 857EB7C8
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCloseAdapter] 85C6EAE0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] 85D6ABA0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisCmRegisterAddressFamily] 85E037A0
IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisClOpenAddressFamily] 857EB700
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisCloseAdapter] 85C55B58
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] 85E4FDB0
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisRegisterProtocol] 85C609D0
IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisReturnPackets] 85C69220
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisReturnPackets] 85250F60
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisRegisterProtocol] 8587F618
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] 85DBA138
IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisCloseAdapter] 852400F0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisReturnPackets] FF065240
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisRegisterProtocol] FEE54120
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisCloseAdapter] FF0905A0
IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] 85ADC9D8
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMRegisterMiniport] FEF3D4D8
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisTerminateWrapper] 853B8508
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisMSetAttributesEx] FC73C330
IAT \SystemRoot\system32\DRIVERS\asyncmac.sys[NDIS.SYS!NdisInitializeWrapper] FC75C938
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
(end)