| MGM_Ghost | 23.06.2014 19:10 |
GMER Log Code:
GMER Logfile:
Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-06-22 21:38:12
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AR1 698,64GB
Running: Gmer-19357.exe; Driver: C:\Users\Roswitha\AppData\Local\Temp\pwtyikob.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a41465 2 bytes [A4, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a414bb 2 bytes [A4, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a41465 2 bytes [A4, 77]
.text C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe[2572] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a414bb 2 bytes [A4, 77]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a41465 2 bytes [A4, 77]
.text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a414bb 2 bytes [A4, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077a41465 2 bytes [A4, 77]
.text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4500] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000077a414bb 2 bytes [A4, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000778911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077891390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007789143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007789158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007789191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077891b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077891bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077891d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077891eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077891edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077891f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077891fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077891fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077892272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077892301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077892792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000778927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007789282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077892890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077892d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077892d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077893023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007789323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000778933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077893a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077893ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077893b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077893d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077894190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000778e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000778e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000778e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000778e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000778e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000778e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000778e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000778e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007544146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000075441a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000075441a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075441a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[2304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000075441a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000778911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077891390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007789143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007789158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007789191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077891b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077891bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077891d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077891eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077891edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077891f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077891fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077891fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077892272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077892301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077892792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000778927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007789282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077892890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077892d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077892d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077893023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007789323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000778933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077893a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077893ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077893b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077893d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077894190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000778e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000778e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000778e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000778e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000778e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000778e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000778e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000778e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007544146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000075441a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000075441a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075441a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[6280] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000075441a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000778911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077891390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007789143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007789158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007789191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077891b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077891bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077891d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077891eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077891edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077891f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077891fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077891fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077892272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077892301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077892792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000778927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007789282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077892890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077892d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077892d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077893023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007789323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000778933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077893a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077893ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077893b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077893d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077894190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000778e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000778e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000778e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000778e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000778e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000778e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000778e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000778e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007544146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000075441a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000075441a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075441a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[6520] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000075441a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000778911f5 8 bytes {JMP 0xd}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000077891390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 000000007789143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 000000007789158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 000000007789191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000077891b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000077891bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000077891d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000077891eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000077891edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000077891f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000077891fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000077891fd7 8 bytes {JMP 0xb}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000077892272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000077892301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000077892792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000778927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000778927d2 8 bytes {JMP 0x10}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 000000007789282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000077892890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000077892d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000077892d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000077893023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 000000007789323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000778933c0 16 bytes {JMP 0x4e}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000077893a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000077893ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000077893b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000077893d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000077894190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 00000000778e1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 00000000778e1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000778e1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000778e1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 00000000778e1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 00000000778e1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 00000000778e1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000778e27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000754413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007544146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000754416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000754416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000754419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000754419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000075441a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000075441a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000075441a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Roswitha\Desktop\Gmer-19357.exe[5304] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000075441a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015008493fa
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\685d43417ae8
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\685d43417ae8@6cf373c010c4 0x78 0x4E 0x73 0x71 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\685d43417ae8@00158354c027 0x3A 0xF2 0xA0 0xB8 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\685d43417ae8@14f42ac62b61 0x3D 0xBA 0x31 0x3C ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015008493fa (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\685d43417ae8 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\685d43417ae8@6cf373c010c4 0x78 0x4E 0x73 0x71 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\685d43417ae8@00158354c027 0x3A 0xF2 0xA0 0xB8 ...
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\685d43417ae8@14f42ac62b61 0x3D 0xBA 0x31 0x3C ...
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
--- --- ---
|
So funktioniert es:
Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
TDSSKiller.exe und speichere diese Datei auf dem Desktop
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
