GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-06-27 20:48:36 Windows 6.1.7600 Running: gmer.exe; Driver: C:\Users\ROB\AppData\Local\Temp\ufldrpow.sys ---- System - GMER 1.0.15 ---- INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82834AF8 INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82834104 INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828343F4 INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8281C634 INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8281C898 INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828341DC INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82834958 INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828346F8 INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82834F2C INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828351A8 Code 86BE7C4C ZwTraceEvent Code 86BE7C4B NtTraceEvent ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!NtTraceEvent 82883E34 5 Bytes JMP 86BE7C50 .text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82894599 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 828B8F52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text peauth.sys 98362C9D 28 Bytes [84, D9, 97, 27, 45, 88, B5, ...] .text peauth.sys 98362CC1 28 Bytes [84, D9, 97, 27, 45, 88, B5, ...] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CreateDialogParamW 75EA9BFF 5 Bytes JMP 6CE9C578 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!EnableWindow 75EAA72E 5 Bytes JMP 6CE9C4F3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!GetAsyncKeyState 75EAC09A 5 Bytes JMP 6CE5D6E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!UnhookWindowsHookEx 75EACC7B 5 Bytes JMP 6CF5835E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CallNextHookEx 75EACC8F 5 Bytes JMP 6CF39D5C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CreateWindowExW 75EB0E51 5 Bytes JMP 6CF48157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!SetWindowsHookExW 75EB210A 5 Bytes JMP 6CEF4633 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!GetKeyState 75EB4FDA 5 Bytes JMP 6CE9D76A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!IsDialogMessageW 75EB6F06 5 Bytes JMP 6CE64284 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CreateDialogParamA 75EC3E79 5 Bytes JMP 6D0701E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!IsDialogMessage 75EC407A 5 Bytes JMP 6D06FA8A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CreateDialogIndirectParamA 75EC9110 5 Bytes JMP 6D070220 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!CreateDialogIndirectParamW 75ED08AD 5 Bytes JMP 6D070257 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!DialogBoxIndirectParamW 75ED4AA7 5 Bytes JMP 6D06F5E8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!EndDialog 75ED555C 5 Bytes JMP 6CE65AE9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!DialogBoxParamW 75ED564A 5 Bytes JMP 6CE64BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!SetKeyboardState 75ED6B52 5 Bytes JMP 6D06FDEF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!SendInput 75ED7055 5 Bytes JMP 6D0709B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!SetCursorPos 75EEC1D8 5 Bytes JMP 6D070A0C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!DialogBoxParamA 75EECF6A 5 Bytes JMP 6D06F585 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!DialogBoxIndirectParamA 75EED29C 5 Bytes JMP 6D06F64B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!MessageBoxIndirectA 75EFE8C9 5 Bytes JMP 6D06F51A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!MessageBoxIndirectW 75EFE9C3 5 Bytes JMP 6D06F4AF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!MessageBoxExA 75EFEA29 5 Bytes JMP 6D06F44D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!MessageBoxExW 75EFEA4D 5 Bytes JMP 6D06F3EB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] USER32.dll!keybd_event 75EFEC9B 5 Bytes JMP 6D070D3F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] SHELL32.dll!SHChangeNotification_Lock + 45BA 7688B3E8 4 Bytes [11, 36, 5D, 73] .text C:\Program Files\Internet Explorer\iexplore.exe[3724] SHELL32.dll!SHChangeNotification_Lock + 45C2 7688B3F0 8 Bytes [5F, 35, 5D, 73, D0, 73, 5C, ...] .text C:\Program Files\Internet Explorer\iexplore.exe[3724] ole32.dll!OleLoadFromStream 774A5B88 5 Bytes JMP 6D06F946 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3724] ole32.dll!CoCreateInstance 774F57FC 5 Bytes JMP 6CF48C45 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Heroes of Newerth\hon.exe[3752] kernel32.dll!SetUnhandledExceptionFilter 77653142 5 Bytes JMP 152510B0 C:\Program Files\Heroes of Newerth\k2.dll .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CreateDialogParamW 75EA9BFF 5 Bytes JMP 6CE9C578 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!EnableWindow 75EAA72E 5 Bytes JMP 6CE9C4F3 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!GetAsyncKeyState 75EAC09A 5 Bytes JMP 6CE5D6E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!UnhookWindowsHookEx 75EACC7B 5 Bytes JMP 6CF5835E C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CallNextHookEx 75EACC8F 5 Bytes JMP 6CF39D5C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CreateWindowExW 75EB0E51 5 Bytes JMP 6CF48157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!SetWindowsHookExW 75EB210A 5 Bytes JMP 6CEF4633 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!GetKeyState 75EB4FDA 5 Bytes JMP 6CE9D76A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!IsDialogMessageW 75EB6F06 5 Bytes JMP 6CE64284 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CreateDialogParamA 75EC3E79 5 Bytes JMP 6D0701E9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!IsDialogMessage 75EC407A 5 Bytes JMP 6D06FA8A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CreateDialogIndirectParamA 75EC9110 5 Bytes JMP 6D070220 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!CreateDialogIndirectParamW 75ED08AD 5 Bytes JMP 6D070257 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!DialogBoxIndirectParamW 75ED4AA7 5 Bytes JMP 6D06F5E8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!EndDialog 75ED555C 5 Bytes JMP 6CE65AE9 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!DialogBoxParamW 75ED564A 5 Bytes JMP 6CE64BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!SetKeyboardState 75ED6B52 5 Bytes JMP 6D06FDEF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!SendInput 75ED7055 5 Bytes JMP 6D0709B4 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!SetCursorPos 75EEC1D8 5 Bytes JMP 6D070A0C C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!DialogBoxParamA 75EECF6A 5 Bytes JMP 6D06F585 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!DialogBoxIndirectParamA 75EED29C 5 Bytes JMP 6D06F64B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!MessageBoxIndirectA 75EFE8C9 5 Bytes JMP 6D06F51A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!MessageBoxIndirectW 75EFE9C3 5 Bytes JMP 6D06F4AF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!MessageBoxExA 75EFEA29 5 Bytes JMP 6D06F44D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!MessageBoxExW 75EFEA4D 5 Bytes JMP 6D06F3EB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] USER32.dll!keybd_event 75EFEC9B 5 Bytes JMP 6D070D3F C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] SHELL32.dll!SHChangeNotification_Lock + 45BA 7688B3E8 4 Bytes [11, 36, 5D, 73] .text C:\Program Files\Internet Explorer\iexplore.exe[3952] SHELL32.dll!SHChangeNotification_Lock + 45C2 7688B3F0 8 Bytes [5F, 35, 5D, 73, D0, 73, 5C, ...] .text C:\Program Files\Internet Explorer\iexplore.exe[3952] ole32.dll!OleLoadFromStream 774A5B88 5 Bytes JMP 6D06F946 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3952] ole32.dll!CoCreateInstance 774F57FC 5 Bytes JMP 6CF48C45 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!CreateWindowExW 75EB0E51 5 Bytes JMP 6CF48157 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!DialogBoxIndirectParamW 75ED4AA7 5 Bytes JMP 6D06F5E8 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!DialogBoxParamW 75ED564A 5 Bytes JMP 6CE64BA7 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!DialogBoxParamA 75EECF6A 5 Bytes JMP 6D06F585 C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!DialogBoxIndirectParamA 75EED29C 5 Bytes JMP 6D06F64B C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!MessageBoxIndirectA 75EFE8C9 5 Bytes JMP 6D06F51A C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!MessageBoxIndirectW 75EFE9C3 5 Bytes JMP 6D06F4AF C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!MessageBoxExA 75EFEA29 5 Bytes JMP 6D06F44D C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) .text C:\Program Files\Internet Explorer\iexplore.exe[3992] USER32.dll!MessageBoxExW 75EFEA4D 5 Bytes JMP 6D06F3EB C:\Windows\system32\IEFRAME.dll (Internet Browser/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume4 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume5 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume6 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\0000003d halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) ---- EOF - GMER 1.0.15 ----