GMER: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-09-24 19:30:32
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST320005 rev.CC34 1863,02GB
Running: Gmer-19357.exe; Driver: C:\Users\mia\AppData\Local\Temp\pftdypow.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 680 fffff800031a6098 93 bytes [48, 8B, 84, 24, E8, 00, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 774 fffff800031a60f6 24 bytes [22, C4, 44, 8B, CB, 65, 4C, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1708] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 00000000774dfaa8 5 bytes JMP 0000000173d118dd
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe[1708] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 00000000774e0038 5 bytes JMP 0000000173d11ed6
.text C:\Windows\SysWOW64\PnkBstrA.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072df1a22 2 bytes [DF, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072df1ad0 2 bytes [DF, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072df1b08 2 bytes [DF, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072df1bba 2 bytes [DF, 72]
.text C:\Windows\SysWOW64\PnkBstrA.exe[1204] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072df1bda 2 bytes [DF, 72]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000763f1465 2 bytes [3F, 76]
.text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[1396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000763f14bb 2 bytes [3F, 76]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772e11f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000772e1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772e143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000772e158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772e191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000772e1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000772e1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000772e1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000772e1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000772e1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000772e1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000772e1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000772e1fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000772e2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000772e2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000772e2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772e27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772e27d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000772e282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000772e2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000772e2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000772e2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000772e3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000772e323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772e33c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000772e3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772e3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772e3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000772e3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000772e4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077331380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077331500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077331530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077331650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077331700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077331d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077331f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773327e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074de13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074de146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074de16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074de16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074de19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074de19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074de1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074de1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074de1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5460] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074de1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 00000000772e11f5 8 bytes {JMP 0xd}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 00000000772e1390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 00000000772e143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 00000000772e158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 00000000772e191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 00000000772e1b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 00000000772e1bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 00000000772e1d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 00000000772e1eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 00000000772e1edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 00000000772e1f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 00000000772e1fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 00000000772e1fd7 8 bytes {JMP 0xb}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 00000000772e2272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 00000000772e2301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 00000000772e2792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 00000000772e27b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 00000000772e27d2 8 bytes {JMP 0x10}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 00000000772e282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 00000000772e2890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 00000000772e2d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 00000000772e2d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 00000000772e3023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 00000000772e323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 00000000772e33c0 16 bytes {JMP 0x4e}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 00000000772e3a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 00000000772e3ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 00000000772e3b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 00000000772e3d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 00000000772e4190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000077331380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000077331500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077331530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077331650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000077331700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000077331d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000077331f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 00000000773327e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 0000000074de13cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 0000000074de146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 0000000074de16d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 0000000074de16e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 0000000074de19db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 0000000074de19fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074de1a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074de1a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074de1a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\mia\Desktop\Gmer-19357.exe[5872] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074de1a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Processes - GMER 2.1 ----
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\klavemu.kdl.6e86633e63e607038cfa66d3f88c5d60 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Heuristics engine/Kaspersky Lab ZAO)(2014-04-17 10:41:06) 0000000067a00000
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\kjim.kdl.d4e5f800473001b23e283d91de9755fb (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Script Heuristics Engine/Kaspersky Lab ZAO)(2014-07-08 14:26:50) 00000000676b0000
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\mark.kdl.1ec35d35788a9bc270a3b447405ab577 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Anti-Rootkit Engine/Kaspersky Lab ZAO)(2014-07-14 10:42:30) 00000000683b0000
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\qscan.kdl.94c366b442c3accc919782ce5f0d7fd0 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Initial Scan Engine/Kaspersky Lab ZAO)(2014-08-07 10:15:04) 0000000067580000
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\kavsys.kdl.3cbce9162519ae9d590238cb927fbb55 (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Set of system interfaces/Kaspersky Lab ZAO)(2014-08-07 10:15:07) 000000006f680000
Library C:\ProgramData\Kaspersky Lab\AVP14.0.0\Bases\Cache\arkmon.kdl.cabb8d489588e2bad1456f23067a62ef (*** suspicious ***) @ C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\avp.exe [1708] (Anti-Rootkit Monitor/Kaspersky Lab ZAO)(2014-07-14 10:42:33) 000000006f300000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
Malwarebytes Anti-Malware 
AdwCleaner auf deinen Desktop.
SecurityCheck und:
WARNUNG an die MITLESER: 
