[Closed] Txt docs for trojanDownloader:Win32/Renos.IO

Here are my windos vista system txt scan docs


DDS (Ver_09-05-14.01) - NTFSx86
Run by [removed] at 21:25:02,96 on 02/06/2009
Internet Explorer: 7.0.6001.18000
Microsoft® Windows Vista™ Home Premium 6.0.6001.1.1252.34.3082.18.2047.1190 [GMT 2:00]

AV: Norton Internet Security *On-access scanning disabled* (Outdated) {E10A9785-9598-4754-B552-92431C1C35F8}
SP: Windows Defender *enabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
SP: Norton Internet Security *enabled* (Outdated) {CBB7EE13-8244-4DAB-8B55-D5C7AA91E59A}
FW: Norton Internet Security *enabled* {7C21A4C9-F61F-4AC4-B722-A6E19C16F220}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\System32\svchost.exe -k NetworkService
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\system32\Ati2evxx.exe
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\Ati2evxx.exe
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
c:\Program Files\Common Files\Symantec Shared\AppCore\AppSvc32.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Windows Live\Family Safety\fsssvc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\WUDFHost.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Windows Defender\MSASCui.exe
C:\hp\support\hpsysdrv.exe
C:\Program Files\Hewlett-Packard\On-Screen OSD Indicator\OSD.exe
C:\Windows\RtHDVCpl.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Windows Live\Family Safety\fsui.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools Lite\daemon.exe
C:\Fraps\fraps.exe
C:\Windows\system32\schtasks.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
C:\Windows\system32\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
c:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Windows\system32\vssvc.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\taskeng.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Windows\System32\mobsync.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Windows Live\Toolbar\wltuser.exe
C:\Windows\system32\SearchProtocolHost.exe
C:\Windows\system32\SearchFilterHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Windows\system32\DllHost.exe
C:\Users\anita\Desktop\dds.pif
C:\Windows\system32\conime.exe
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://www.google.es/
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=ES_ES&c=74&bd=Presario&pf=desktop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=ES_ES&c=74&bd=Presario&pf=desktop
BHO: Aplicación auxiliar de vínculos de Adobe PDF Reader: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: {1e8a6170-7264-4d0f-beae-d42a53123c75} - c:\program files\common files\symantec shared\coshared\browser\1.5\NppBho.dll
BHO: AskBar BHO: {201f27d4-3704-41d6-89c1-aa35e39143ed} - c:\program files\askbardis\bar\bin\askBar.dll
BHO: Windows Live Family Safety Browser Helper Class: {4f3ed5cd-0726-42a9-87f5-d13f3d2976ac} - c:\program files\windows live\family safety\fssbho.dll
BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
BHO: Windows Live Aplicación auxiliar de inicio de sesión: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\googletoolbar1.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\googletoolbar1.dll
TB: Show Norton Toolbar: {90222687-f593-4738-b738-fbee9c7b26df} - c:\program files\common files\symantec shared\coshared\browser\1.5\UIBHO.dll
TB: Ask Toolbar: {3041d03e-fd4b-44e0-b742-2d9b88305f98} - c:\program files\askbardis\bar\bin\askBar.dll
TB: DAEMON Tools Toolbar: {32099aac-c132-4136-9e9a-4e364a424e17} - c:\program files\daemon tools toolbar\DTToolbar.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
uRun: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter
uRun: [msnmsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [DAEMON Tools Lite] "c:\program files\daemon tools lite\daemon.exe" -autorun
uRun: [Fraps] c:\fraps\FRAPS.EXE
uRun: [Second Wave] "c:\programdata\camp this this.7ibhu"
uRun: [eMuleAutoStart] c:\program files\emule\emule.exe -AutoStart
mRun: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
mRun: [hpsysdrv] c:\hp\support\hpsysdrv.exe
mRun: [OsdMaestro] "c:\program files\hewlett-packard\on-screen osd indicator\OSD.exe"
mRun: [RtHDVCpl] RtHDVCpl.exe
mRun: [HP Health Check Scheduler] c:\program files\hewlett-packard\hp health check\HPHC_Scheduler.exe
mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 8.0\reader\Reader_sl.exe"
mRun: [SunJavaUpdateReg] "c:\windows\system32\jureg.exe"
mRun: [ccApp] "c:\program files\common files\symantec shared\ccApp.exe"
mRun: [Symantec PIF AlertEng] "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\pifsvc.exe" /a /m "c:\program files\common files\symantec shared\pif\{b8e1dd85-8582-4c61-b58f-2f227fca9a08}\AlertEng.dll"
mRun: [StartCCC] "c:\program files\ati technologies\ati.ace\core-static\CLIStart.exe"
mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
mRun: [HP Software Update] c:\program files\hp\hp software update\HPWuSchd2.exe
mRun: [fssui] "c:\program files\windows live\family safety\fsui.exe" -autorun
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
dRunOnce: []
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xportar a Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_01\bin\ssv.dll
IE: {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - {5F7B1267-94A9-47F5-98DB-E99415F33AEC} - c:\program files\windows live\writer\WriterBrowserExtension.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} - hxxp://upload.facebook.com/controls/2008.10.10_v5.5.8/FacebookPhotoUploader5.cab
DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - hxxp://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.8.110.cab
DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} - hxxps://h20436.www2.hp.com/ediags/dex/secure/HPDEXAXO.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
TCP: NameServer = 85.255.112.141,85.255.112.91
TCP: {79356483-33A5-4182-9397-CE944347A97E} = 85.255.112.141,85.255.112.91
TCP: {89C443C9-CB0A-496F-A97D-362EAE32C4B5} = 85.255.112.141,85.255.112.91
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL

============= SERVICES / DRIVERS ===============

R1 IDSvix86;Symantec Intrusion Prevention Driver;c:\progra~2\symantec\defini~1\symcdata\idsdefs\20090303.001\IDSvix86.sys [2009-3-6 270384]
R2 fssfltr;FssFltr;c:\windows\system32\drivers\fssfltr.sys [2009-2-22 55280]
R2 fsssvc;Windows Live Protección Infantil;c:\program files\windows live\family safety\fsssvc.exe [2009-2-6 533360]
R2 Programador de LiveUpdate automático;Programador de LiveUpdate automático;c:\program files\symantec\liveupdate\AluSchedulerSvc.exe [2007-1-7 554352]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R3 A5AGU;D-Link Wireless LAN 802.11 USB device driver;c:\windows\system32\drivers\AGUx86.sys [2009-1-10 892416]
R3 SYMNDISV;SYMNDISV;c:\windows\system32\drivers\symndisv.sys [2008-10-3 37936]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files\common files\symantec shared\eengine\EraserUtilRebootDrv.sys [2009-2-27 101936]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]

=============== Created Last 30 ================

2009-05-29 01:06 –d—– c:\windows\pss
2009-05-28 19:46 –d—– c:\program files\temp
2009-05-28 19:45 –d—– c:\windows\system32\ocr
2009-05-28 19:45 –d—– c:\windows\system32\Data
2009-05-28 19:45 –d—– c:\program files\XenoBlast.exe
2009-05-28 19:45 –d—– c:\windows\system32\Plugins
2009-05-27 21:18 –d—– c:\users\anita\appdata\roaming\Microsoft Games
2009-05-27 21:14 –d—– c:\program files\Rise of Nations Gold
2009-05-27 21:10 44 a——- c:\windows\atmos.ini
2009-05-27 21:10 398,416 ——– c:\windows\system\VBRUN300.DLL
2009-05-27 21:10 64,544 ——– c:\windows\system\THREED.VBX
2009-05-27 21:10 26,272 ——– c:\windows\system\FXWIN.DLL
2009-05-27 21:10 22,528 ——– c:\windows\system\SPIN.VBX
2009-05-27 21:10 18,688 ——– c:\windows\system\CMDIALOG.VBX
2009-05-27 21:10 –d—– C:\FEAR
2009-05-26 15:34 –d—– c:\program files\directx
2009-05-26 15:31 974,848 a—-r– c:\windows\system32\vorbis.dll
2009-05-26 15:31 49,152 a—-r– c:\windows\system32\ogg.dll
2009-05-26 15:31 28,672 a—-r– c:\windows\system32\vorbisfile.dll
2009-05-21 22:43 –d—– c:\program files\Crimsonland
2009-05-21 22:43 –d—– c:\program files\ReflexiveArcade
2009-05-21 19:39 –d—– c:\program files\Hidden Expedition - Amazon
2009-05-21 19:38 –d—– c:\program files\Gringomaquina
2009-05-21 19:30 –d—– c:\program files\Mr. Robot
2009-05-21 00:16 0 a—h— c:\windows\system32\drivers\Msft_Kernel_ccdcmb_01005.Wdf
2009-05-17 23:19 69 a——- c:\windows\NeroDigital.ini
2009-05-17 15:53 2,784,285 a——- c:\windows\system32\GameMon.des
2009-05-17 15:52 5,174 a——- c:\windows\system32\nppt9x.vxd
2009-05-17 15:52 4,682 a——- c:\windows\system32\npptNT2.sys
2009-05-17 15:52 –d—– c:\program files\common files\INCA Shared
2009-05-17 15:27 710,064 a——- c:\windows\system32\ijjiSetup.exe
2009-05-17 15:27 157,152 a——- c:\windows\system32\PubPlugin.dll
2009-05-17 15:27 58,800 a——- c:\windows\system32\ijjiPlugin2.dll
2009-05-17 15:27 –d—– c:\program files\NHN USA
2009-05-17 15:12 –d—– C:\ijji
2009-05-17 12:24 –d—– c:\program files\eMule
2009-05-15 21:21 –d—– c:\program files\Team17 Software Ltd
2009-05-13 23:23 107,888 a——- c:\windows\system32\CmdLineExt.dll
2009-05-13 23:21 –d—– c:\programdata\BCR
2009-05-13 23:21 –d—– c:\progra~2\BCR
2009-05-13 23:18 –d—– c:\program files\OpenAL
2009-05-13 23:18 418,480 a——- c:\windows\system32\wrap_oal.dll
2009-05-13 23:18 115,432 a——- c:\windows\system32\OpenAL32.dll
2009-05-13 23:18 –d—– c:\program files\Capcom
2009-05-13 21:19 –d—– c:\program files\Shadowgrounds
2009-05-12 14:52 –d—– c:\program files\Undercover
2009-05-08 23:08 –d—– c:\program files\Universal Interactive
2009-05-08 21:12 –d—– c:\program files\WizardWorks
2009-05-08 21:11 284,672 a——- c:\windows\unin040a.exe
2009-05-07 01:05 –d—– c:\users\anita\appdata\roaming\PopCapv1002
2009-05-07 01:04 –d—– c:\programdata\SpinTop Games
2009-05-07 01:04 –d—– c:\progra~2\SpinTop Games
2009-05-06 21:35 47,104 a——- c:\windows\system32\KMVIDC32.DLL
2009-05-06 21:35 –d—– C:\Team17
2009-05-06 21:35 314,880 a——- c:\windows\IsUninst.exe
2009-05-06 21:24 77 a——- c:\windows\popcinfo.dat
2009-05-06 21:24 –d—– c:\program files\PopCap Games
2009-05-06 08:33 –d—– c:\programdata\PopCap Games
2009-05-06 08:33 –d—– c:\progra~2\PopCap Games
2009-05-06 08:30 –d—– c:\program files\Steveredrum
2009-05-05 23:36 528 a——- c:\windows\eReg.dat
2009-05-05 23:35 –d—– c:\program files\EA Games
2009-05-05 21:35 –d—– c:\program files\Empire Interactive
2009-05-05 21:20 –d—– c:\users\anita\appdata\roaming\Alawar
2009-05-05 21:18 –d—– c:\program files\Strike Ball 3
2009-05-04 00:18 –d—– c:\users\anita\appdata\roaming\Babylon
2009-05-04 00:18 –d—– c:\programdata\Babylon
2009-05-04 00:18 –d—– c:\progra~2\Babylon
2009-05-03 23:58 –d—– c:\programdata\Mode Rule 64 Inter
2009-05-03 23:58 –d—– c:\progra~2\Mode Rule 64 Inter
2009-05-03 23:57 –d—– c:\programdata\Delete Move Save
2009-05-03 23:57 –d—– c:\progra~2\Delete Move Save

==================== Find3M ====================

2009-06-02 16:07 674,294 a——- c:\windows\system32\perfh00A.dat
2009-06-02 16:07 134,260 a——- c:\windows\system32\perfc00A.dat
2009-05-21 00:19 143,360 a——- c:\windows\inf\infstrng.dat
2009-05-21 00:19 51,200 a——- c:\windows\inf\infpub.dat
2009-05-21 00:18 86,016 a——- c:\windows\inf\infstor.dat
2009-03-17 05:38 40,960 a——- c:\windows\apppatch\apihex86.dll
2009-03-17 05:38 13,824 a——- c:\windows\system32\apilogen.dll
2009-03-17 05:38 24,064 a——- c:\windows\system32\amxread.dll
2009-02-21 01:52 174 a–sh— c:\program files\desktop.ini
2009-02-21 01:42 665,600 a——- c:\windows\inf\drvindex.dat
2007-01-08 05:51 336,930 a——- c:\windows\inf\perflib\0c0a\perfi.dat
2007-01-08 05:51 336,930 a——- c:\windows\inf\perflib\0c0a\perfh.dat
2007-01-08 05:51 40,258 a——- c:\windows\inf\perflib\0c0a\perfd.dat
2007-01-08 05:51 40,258 a——- c:\windows\inf\perflib\0c0a\perfc.dat
2006-11-02 11:20 287,440 a——- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 11:20 287,440 a——- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 11:20 30,674 a——- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 11:20 30,674 a——- c:\windows\inf\perflib\0000\perfc.dat
2007-01-08 06:09 8,192 a–sh— c:\windows\users\default\NTUSER.DAT

============= FINISH: 21:26:52,68 ===============



GMER TXT LOG


GMER 1.0.15.14972 - http://www.gmer.net
Rootkit scan 2009-06-02 22:08:58
Windows 6.0.6001 Service Pack 1


—- System - GMER 1.0.15 —-

SSDT 86096190 ZwAlertResumeThread
SSDT 86096270 ZwAlertThread
SSDT 860E9788 ZwAllocateVirtualMemory
SSDT 8600B5F8 ZwConnectPort
SSDT 8610A6E8 ZwCreateMutant
SSDT 8612C898 ZwCreateThread
SSDT 860926F0 ZwFreeVirtualMemory
SSDT 8610A7D8 ZwImpersonateAnonymousToken
SSDT 860960B0 ZwImpersonateThread
SSDT 86092610 ZwMapViewOfSection
SSDT 8610A608 ZwOpenEvent
SSDT 860E9578 ZwOpenProcessToken
SSDT 860C0600 ZwOpenThreadToken
SSDT 86110FD0 ZwResumeThread
SSDT 860C0520 ZwSetContextThread
SSDT 860C06F0 ZwSetInformationProcess
SSDT 860C0430 ZwSetInformationThread
SSDT 8610A528 ZwSuspendProcess
SSDT 860963B8 ZwSuspendThread
SSDT 86110468 ZwTerminateProcess
SSDT 86096498 ZwTerminateThread
SSDT 860C07E0 ZwUnmapViewOfSection
SSDT 860E96B8 ZwWriteVirtualMemory

INT 0x51 ? 85CD3BF8
INT 0x72 ? 85CD3BF8
INT 0x82 ? 85CD3BF8
INT 0x92 ? 84086BF8
INT 0xA2 ? 84086BF8
INT 0xB2 ? 84086BF8
INT 0xB2 ? 84086BF8
INT 0xB2 ? 85CD3BF8
INT 0xB2 ? 84086BF8

Code 85EBE478 ZwEnumerateKey
Code 86046698 ZwFlushInstructionCache
Code 85FCB9D5 IofCallDriver
Code 8604F846 IofCompleteRequest

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!IofCompleteRequest 81C41FE2 5 Bytes JMP 8604F84B
.text ntkrnlpa.exe!KeSetTimerEx + 350 81CC0914 8 Bytes [90, 61, 09, 86, 70, 62, 09, …] {NOP ; POPA ; OR [ESI-0x79f69d90], EAX}
.text ntkrnlpa.exe!KeSetTimerEx + 365 81CC0929 3 Bytes [97, 0E, 86]
.text ntkrnlpa.exe!KeSetTimerEx + 3F4 81CC09B8 4 Bytes [F8, B5, 00, 86]
.text ntkrnlpa.exe!KeSetTimerEx + 428 81CC09EC 4 Bytes CALL 2A521A97
.text ntkrnlpa.exe!KeSetTimerEx + 454 81CC0A18 4 Bytes [98, C8, 12, 86]
.text …
.text ntkrnlpa.exe!IofCallDriver 81CC3F6F 5 Bytes JMP 85FCB9DA
PAGE ntkrnlpa.exe!ZwFlushInstructionCache 81DBA30B 5 Bytes JMP 8604669C
PAGE ntkrnlpa.exe!ZwEnumerateKey 81E0FBA2 5 Bytes JMP 85EBE47C
? System32\Drivers\spcu.sys El sistema no puede encontrar la ruta especificada. !
.text USBPORT.SYS!DllUnload 8C1E146F 5 Bytes JMP 85CD31D8

—- User code sections - GMER 1.0.15 —-

.text C:\Program Files\Windows Live\Family Safety\fsssvc.exe[1324] ADVAPI32.dll!RegOpenKeyExA 75F6D4E8 5 Bytes JMP 0100F7BF C:\Program Files\Windows Live\Family Safety\fsssvc.exe (Family Safety Service/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!DialogBoxIndirectParamW 763DBD25 5 Bytes JMP 6E895B3B C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!DialogBoxParamW 763F1FD5 5 Bytes JMP 6E895AC5 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!DialogBoxParamA 764180B2 5 Bytes JMP 6E895B00 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!DialogBoxIndirectParamA 764183DD 5 Bytes JMP 6E895B76 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!MessageBoxIndirectA 7642D471 5 Bytes JMP 6E895A81 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!MessageBoxIndirectW 7642D56B 5 Bytes JMP 6E895A3D C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!MessageBoxExA 7642D5D1 5 Bytes JMP 6E895A03 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] USER32.dll!MessageBoxExW 7642D5F5 5 Bytes JMP 6E8959C9 C:\Windows\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] SHELL32.dll!SHRestricted + DFD 76968390 4 Bytes [99, 0B, FC, 6F] {CDQ ; OR EDI, ESP; OUTSD }
.text C:\Program Files\Internet Explorer\iexplore.exe[5212] SHELL32.dll!SHRestricted + E05 76968398 8 Bytes [A7, 0A, FC, 6F, A4, 32, FB, …] {CMPSD ; OR BH, AH; OUTSD ; MOVSB ; XOR BH, BL; OUTSD }

—- Kernel IAT/EAT - GMER 1.0.15 —-

IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [8068C6D2] \SystemRoot\System32\Drivers\spcu.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [8068C040] \SystemRoot\System32\Drivers\spcu.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [8068C7FC] \SystemRoot\System32\Drivers\spcu.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortUshort] [8068C0BE] \SystemRoot\System32\Drivers\spcu.sys
IAT \SystemRoot\system32\drivers\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [8068C13C] \SystemRoot\System32\Drivers\spcu.sys
IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [8069C048] \SystemRoot\System32\Drivers\spcu.sys

—- User IAT/EAT - GMER 1.0.15 —-

IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryExW] [6FFAD537] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW] [6FFAB6A1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SearchPathW] [6FFAF233] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SearchPathW] [6FFAF233] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [6FFAD537] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CopyFileW] [6FFAB6A1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!MoveFileW] [6FFADE50] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetCurrentDirectoryW] [6FFAF49D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindClose] [6FFB0D4C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindNextFileW] [6FFAFC09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!FindFirstFileW] [6FFB02A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!WritePrivateProfileStringW] [6FFAB114] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetPrivateProfileStringW] [6FFAA970] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegQueryInfoKeyW] [6FFBDB0F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegEnumValueW] [6FFBE479] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegOpenKeyExW] [6FFBCB9D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegQueryValueExW] [6FFBD773] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegDeleteKeyW] [6FFBCEA5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCreateKeyExW] [6FFBC625] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCloseKey] [6FFBCD09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindClose] [6FFB0D4C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindFirstFileA] [6FFAFF42] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindNextFileA] [6FFAFB96] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindFirstFileW] [6FFB02A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!FindNextFileW] [6FFAFC09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!GetFileAttributesA] [6FFA89D0] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetCurrentDirectoryA] [6FFAEBFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetFileAttributesA] [6FFA8C26] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateDirectoryA] [6FFAE3CB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!RemoveDirectoryA] [6FFAE9A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!DeleteFileA] [6FFAC1D6] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!GetFileAttributesW] [6FFA8AFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetCurrentDirectoryW] [6FFAF49D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!SetFileAttributesW] [6FFA8D54] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateDirectoryW] [6FFAE4F9] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!MoveFileW] [6FFADE50] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!RemoveDirectoryW] [6FFAEAD0] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!MoveFileA] [6FFADDDD] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateFileA] [6FFABBD2] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\msvcrt.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!ReplaceFileW] [6FFAE151] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!WritePrivateProfileStringW] [6FFAB114] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringW] [6FFAA970] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetPrivateProfileStringA] [6FFAA819] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [6FFAD537] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW] [6FFA8D54] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileW] [6FFB02A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileW] [6FFAFC09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathW] [6FFAF233] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesW] [6FFA8AFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA] [6FFA8C26] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA] [6FFABBD2] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindFirstFileA] [6FFAFF42] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindNextFileA] [6FFAFB96] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!FindClose] [6FFB0D4C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SearchPathA] [6FFAEFA8] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetFileAttributesA] [6FFA89D0] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!WinHelpW] [6FFACF65] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [USER32.dll!WinHelpA] [6FFACE2E] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCloseKey] [6FFBCD09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExA] [6FFBC49D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteKeyA] [6FFBCD5C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryInfoKeyA] [6FFBD913] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExA] [6FFBCA25] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExW] [6FFBC625] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExW] [6FFBCB9D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyExW] [6FFBE169] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueW] [6FFBD437] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteKeyW] [6FFBCEA5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryInfoKeyW] [6FFBDB0F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueExW] [6FFBD773] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumValueW] [6FFBE479] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyW] [6FFBDE75] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyExA] [6FFBDFE1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumValueA] [6FFBE2F1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegEnumKeyA] [6FFBDD0B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegQueryValueExA] [6FFBD5D3] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionW] [6FFAA460] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindNextFileW] [6FFAFC09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!ReplaceFileW] [6FFAE151] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileSectionNamesW] [6FFAA6E2] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileSectionW] [6FFAAE92] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!WritePrivateProfileStringW] [6FFAB114] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateHardLinkW] [6FFAC023] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW] [6FFAB6A1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetBinaryTypeW] [6FFA9700] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [6FFAD537] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW] [6FFADE50] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindFirstFileW] [6FFB02A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!FindClose] [6FFB0D4C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameA] [6FFA9362] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesA] [6FFA89D0] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SearchPathW] [6FFAF233] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileIntW] [6FFAA1D8] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetPrivateProfileStringW] [6FFAA970] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!RemoveDirectoryW] [6FFAEAD0] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateDirectoryW] [6FFAE4F9] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetFileAttributesW] [6FFA8D54] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesW] [6FFA8AFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW] [6FFADE75] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetShortPathNameW] [6FFA94A1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetFileAttributesExW] [6FFA8FC1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetLongPathNameW] [6FFA9231] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetCurrentDirectoryW] [6FFAF49D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [USER32.dll!LoadImageW] [6FFAC58B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [USER32.dll!WinHelpW] [6FFACF65] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [USER32.dll!PrivateExtractIconsW] [6FFACA80] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExW] [6FFBCB9D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyExW] [6FFBC625] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegEnumKeyW] [6FFBDE75] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegEnumValueW] [6FFBE479] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegDeleteKeyW] [6FFBCEA5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegQueryInfoKeyW] [6FFBDB0F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegQueryInfoKeyA] [6FFBD913] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegEnumKeyExW] [6FFBE169] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegSetValueW] [6FFBD13F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegQueryValueExW] [6FFBD773] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegQueryValueW] [6FFBD437] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyW] [6FFBC8E9] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyW] [6FFBC35D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegQueryValueExA] [6FFBD5D3] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExA] [6FFBCA25] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCloseKey] [6FFBCD09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\SHELL32.dll [ntdll.dll!NtQueryDirectoryFile] [6FFB91AC] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!FindClose] [6FFB0D4C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!FindFirstFileW] [6FFB02A5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [6FFAD537] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!SearchPathW] [6FFAF233] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!DeleteFileW] [6FFAC301] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetShortPathNameW] [6FFA94A1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesExW] [6FFA8FC1] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateFileW] [6FFABD1B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryW] [6FFAD221] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesW] [6FFA8AFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6FFAD09C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegSetValueW] [6FFBD13F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryValueA] [6FFBD28F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegEnumKeyExW] [6FFBE169] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegEnumValueW] [6FFBE479] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegEnumKeyA] [6FFBDD0B] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegDeleteKeyA] [6FFBCD5C] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryInfoKeyW] [6FFBDB0F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryInfoKeyA] [6FFBD913] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryValueW] [6FFBD437] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegEnumKeyW] [6FFBDE75] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegCloseKey] [6FFBCD09] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryValueExW] [6FFBD773] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExW] [6FFBCB9D] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegDeleteKeyW] [6FFBCEA5] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegCreateKeyExW] [6FFBC625] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegQueryValueExA] [6FFBD5D3] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExA] [6FFBCA25] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueW] [6FFB5CFD] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHRegGetValueA] [6FFB5C9F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathUnExpandEnvStringsA] [6FFB4D95] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteKeyA] [6FFB50AF] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHDeleteValueW] [6FFB519F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCreateFromUrlW] [6FFB40A2] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueA] [6FFB5357] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueA] [6FFB619F] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHGetValueW] [6FFB53B2] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!SHSetValueW] [6FFB61FA] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)
IAT C:\Program Files\Internet Explorer\iexplore.exe[5212] @ C:\Windows\system32\WININET.dll [SHLWAPI.dll!PathCombineW] [6FFB3FFB] C:\Windows\AppPatch\AcRedir.DLL (Windows Compatibility DLL/Microsoft Corporation)

—- Devices - GMER 1.0.15 —-

Device \FileSystem\Ntfs \Ntfs 84A1E1F8
Device \FileSystem\fastfat \FatCdrom 842B0500
Device \Driver\volmgr \Device\VolMgrControl 840881F8
Device \Driver\usbuhci \Device\USBPDO-0 85B4D500
Device \Driver\usbuhci \Device\USBPDO-1 85B4D500
Device \Driver\usbuhci \Device\USBPDO-2 85B4D500
Device \Driver\usbuhci \Device\USBPDO-3 85B4D500
Device \Driver\usbehci \Device\USBPDO-4 85B531F8

AttachedDevice \Driver\tdx \Device\Tcp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\volmgr \Device\HarddiskVolume1 840881F8
Device \Driver\volmgr \Device\HarddiskVolume2 840881F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-2 8408A1F8
Device \Driver\atapi \Device\Ide\IdePort0 8408A1F8
Device \Driver\atapi \Device\Ide\IdePort1 8408A1F8
Device \Driver\atapi \Device\Ide\IdePort2 8408A1F8
Device \Driver\atapi \Device\Ide\IdePort3 8408A1F8
Device \Driver\atapi \Device\Ide\IdeDeviceP2T1L0-4 8408A1F8
Device \Driver\USBSTOR \Device\00000067 860F2500
Device \Driver\USBSTOR \Device\00000068 860F2500
Device \Driver\USBSTOR \Device\00000069 860F2500
Device \Driver\netbt \Device\NetBT_Tcpip_{79356483-33A5-4182-9397-CE944347A97E} 861114B8
Device \Driver\netbt \Device\NetBt_Wins_Export 861114B8
Device \Driver\Smb \Device\NetbiosSmb 860F01F8
Device \Driver\PCI_PNP4161 \Device\0000004e spcu.sys
Device \Driver\iScsiPrt \Device\RaidPort0 85BE01F8
Device \Driver\sptd \Device\891902169 spcu.sys

AttachedDevice \Driver\tdx \Device\Udp SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device \Driver\USBSTOR \Device\0000006a 860F2500
Device \Driver\netbt \Device\NetBT_Tcpip_{89C443C9-CB0A-496F-A97D-362EAE32C4B5} 861114B8
Device \Driver\USBSTOR \Device\0000006b 860F2500
Device \Driver\usbuhci \Device\USBFDO-0 85B4D500
Device \Driver\usbuhci \Device\USBFDO-1 85B4D500
Device \Driver\usbuhci \Device\USBFDO-2 85B4D500
Device \Driver\usbuhci \Device\USBFDO-3 85B4D500
Device \Driver\usbehci \Device\USBFDO-4 85B531F8
Device \Driver\anzu9b8e \Device\Scsi\anzu9b8e1 85BA91F8
Device \Driver\anzu9b8e \Device\Scsi\anzu9b8e1Port5Path0Target0Lun0 85BA91F8
Device \FileSystem\fastfat \Fat 842B0500

AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Administrador de filtros del sistema de archivos de Microsoft/Microsoft Corporation)

Device \FileSystem\cdfs \Cdfs 86DE81F8
—- Processes - GMER 1.0.15 —-

Library \\?\globalroot\systemroot\system32\MSIVXoxncxttxsnwuuboymikoomqbvmirtisr.dll (*** hidden *** ) @ C:\Windows\system32\svchost.exe [900] 0x10000000

—- Services - GMER 1.0.15 —-

Service C:\Windows\system32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys (*** hidden *** ) [SYSTEM] MSIVXserv.sys <– ROOTKIT !!!

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@start 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@type 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@imagepath \systemroot\system32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys@group file system
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXserv \\?\globalroot\systemroot\system32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXl \\?\globalroot\systemroot\system32\MSIVXoxncxttxsnwuuboymikoomqbvmirtisr.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\MSIVXserv.sys\modules@MSIVXclk \\?\globalroot\systemroot\system32\MSIVXbijvuyviolprixefxmxordqphrwnbuom.dll
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x30 0xA8 0xB9 0x67 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD4 0x82 0x58 0x21 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x20 0x4F 0x07 0x68 …
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@start 1
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@type 1
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@imagepath \systemroot\system32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys@group file system
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXserv \\?\globalroot\systemroot\system32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXl \\?\globalroot\systemroot\system32\MSIVXoxncxttxsnwuuboymikoomqbvmirtisr.dll
Reg HKLM\SYSTEM\ControlSet003\Services\MSIVXserv.sys\modules@MSIVXclk \\?\globalroot\systemroot\system32\MSIVXbijvuyviolprixefxmxordqphrwnbuom.dll
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x30 0xA8 0xB9 0x67 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xD4 0x82 0x58 0x21 …
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x20 0x4F 0x07 0x68 …

—- Files - GMER 1.0.15 —-

File C:\Windows\System32\drivers\MSIVXenxvpsepuewypgrvqryptrrblqockrdi.sys 79872 bytes executable <– ROOTKIT !!!
File C:\Windows\System32\MSIVXbijvuyviolprixefxmxordqphrwnbuom.dll 52224 bytes executable
File C:\Windows\System32\MSIVXcount 4 bytes
File C:\Windows\System32\MSIVXoxncxttxsnwuuboymikoomqbvmirtisr.dll 26624 bytes executable

—- EOF - GMER 1.0.15 —-


THANKS