[Resolved] Persistent Trojan

Hello! I have recently gotten a virus on my computer. I figured that this would be a run of the mill malware so I ran Malware bytes in hopes that it would fix it. Malware Bytes did find a couple of things and proceeded to quarantine/delete them. Figuring that everything was okay, I started browsing using firefox only to find that every so often very rarely (mostly after a computer restart or so and within the first 15 minutes of using firefox) a new tab will popup in firefox that doesn't go anywhere. The URL for it doesn't make sense and it's just a blank page. The odd thing is, when I click on the tab, I realize that I can press "back" on it which goes to what sounds like an actual legitimate site but still the page is blank. After this, bitdefender started picking up a weird trojan and would constantly tell me that it had deleted it and that my computer was protected. (I.E I would press Ok to confirm it and about 2 seconds later another box would pop up saying the same trojan had been deleted and that my computer was safe).

Fearing the worst, I ran bitdefender and found nothing and ran bitdefender again this time without the anti-virus protection on and found the trojan and proceeded to remove it and then restarted. It was fine for a few hours but then the exact same events happened again except this time in conjunction to the random trojan, vista was telling me that a host process had crashed and that windows was trying to find a solution for it.

After many bitdefender, malware bytes, super antispyware, and AVG 9.0 free scans, I removed multiple things but I'm still getting the random tab that pops up in firefox every so often and I'm pretty sure my computer is still not clean as there has been a noticeable slow down in overall performance. I have yet to recieve another host process system error or bitdefender saying they've picked up a trojan multiple times but this is subject to change. Below are the DDS and GMER logs. Thank you for your time and help!

DDS

DDS (Ver_10-03-17.01) - NTFSx86
Run by [removed] at 16:41:05.25 on 04/18/2010 Sun
Internet Explorer: 7.0.6002.18005 BrowserJavaVersion: 1.6.0_03
AV: Bitdefender Antivirus *On-access scanning disabled* (Updated) {6C4BB89C-B0ED-4F41-A29C-4373888923BB}
SP: BitDefender Antispyware *disabled* (Updated) {8B2012EC-32D4-494F-BC03-832DB3BDF911}
SP: Windows Defender *disabled* (Updated) {D68DDC3A-831F-4FAE-9E44-DA132C1ACF46}
FW: Bitdefender Firewall *enabled* {4055920F-2E99-48A8-A270-4243D2B8F242}

============== Running Processes ===============

C:\Windows\system32\wininit.exe
C:\Program Files\AVG\AVG9\avgchsvx.exe
C:\Program Files\AVG\AVG9\avgrsx.exe
C:\Windows\system32\lsm.exe
C:\Program Files\AVG\AVG9\avgcsrvx.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\svchost.exe -k rpcss
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\SLsvc.exe
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\system32\WLANExt.exe
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\AVG\AVG9\avgwdsvc.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\System32\svchost.exe -k WerSvcGroup
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\DRIVERS\xaudio.exe
C:\Program Files\AVG\AVG9\avgnsx.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Common Files\BitDefender\BitDefender Communicator\xcommsvr.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\BitDefender\BitDefender 2008\bdagent.exe
C:\Program Files\Common Files\BitDefender\BitDefender Update Service\livesrv.exe
C:\Windows\System32\rundll32.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe
C:\Program Files\Common Files\LogiShrd\LComMgr\LVComSX.exe
C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\AVG\AVG9\avgtray.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Windows\ehome\ehtray.exe
C:\Program Files\Pando Networks\Media Booster\PMB.exe
C:\Program Files\Logitech\SetPoint\SetPoint.exe
C:\Program Files\BitDefender\BitDefender 2008\vsserv.exe
C:\Windows\System32\svchost.exe -kbdx
C:\Windows\System32\rundll32.exe
C:\Windows\ehome\ehmsas.exe
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Program Files\Windows Sidebar\sidebar.exe
C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Winamp\winamp.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\Windows Media Player\wmpnscfg.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\svchost.exe -k swprv
C:\Windows\system32\DllHost.exe
C:\Program Files\BitDefender\BitDefender 2008\seccenter.exe
C:\Users\Young-Jae\Desktop\dds.scr
C:\Windows\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mStart Page = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mDefault_Page_URL = hxxp://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=73&bd=Pavilion&pf=laptop
mWinlogon: Userinit=c:\windows\system32\userinit.exe,,c:\windows\system32\svcserv.exe
BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll
BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg9\avgssie.dll
BHO: Groove GFS Browser Helper: {72853161-30c5-4d22-b7f9-0bbc1d38a37e} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
TB: BitDefender Toolbar: {381ffde8-2394-4f90-b10d-fc6124a40f8c} - c:\program files\bitdefender\bitdefender 2008\IEToolbar.dll
uRun: [Sidebar] "c:\program files\windows sidebar\sidebar.exe" /autoRun
uRun: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "c:\program files\common files\nero\lib\NMBgMonitor.exe"
uRun: [ehTray.exe] c:\windows\ehome\ehTray.exe
uRun: [Pando Media Booster] c:\program files\pando networks\media booster\PMB.exe
mRun: [Windows Defender] "c:\program files\windows defender\MSASCui.exe" -hide
mRun: [QlbCtrl] "c:\program files\hewlett-packard\hp quick launch buttons\QlbCtrl.exe" /Start
mRun: [hpWirelessAssistant] "c:\program files\hewlett-packard\hp wireless assistant\HPWAMain.exe"
mRun: [WAWifiMessage] "c:\program files\hewlett-packard\hp wireless assistant\WiFiMsg.exe"
mRun: [NBKeyScan] "c:\program files\nero\nero8\nero backitup\NBKeyScan.exe"
mRun: [BitDefender Antiphishing Helper] "c:\program files\bitdefender\bitdefender 2008\IEShow.exe"
mRun: [BDAgent] "c:\program files\bitdefender\bitdefender 2008\bdagent.exe"
mRun: [NvSvc] "c:\windows\system32\rundll32.exe" c:\windows\system32\nvsvc.dll,nvsvcStart
mRun: [NvCplDaemon] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvCpl.dll,NvStartup
mRun: [NvMediaCenter] "c:\windows\system32\rundll32.exe" c:\windows\system32\NvMcTray.dll,NvTaskbarInit
mRun: [Logitech Hardware Abstraction Layer] "c:\windows\KHALMNPR.EXE"
mRun: [LogitechCommunicationsManager] "c:\program files\common files\logishrd\lcommgr\Communications_Helper.exe"
mRun: [LVCOMSX] "c:\program files\common files\logishrd\lcommgr\LVComSX.exe"
mRun: [Kernel and Hardware Abstraction Layer] KHALMNPR.EXE
mRun: [GrooveMonitor] "c:\program files\microsoft office\office12\GrooveMonitor.exe"
mRun: [QPService] "c:\program files\hp\quickplay\QPService.exe"
mRun: [AVG9_TRAY] c:\progra~1\avg\avg9\avgtray.exe
mRunOnce: [Launcher] %WINDIR%\SMINST\launcher.exe
StartupFolder: c:\progra~2\micros~1\windows\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\SetPoint.exe
mPolicies-explorer: BindDirectlyToPropertySetStorage = 0 (0x0)
mPolicies-system: EnableLUA = 0 (0x0)
mPolicies-system: EnableUIADesktopToggle = 0 (0x0)
IE: E&xport to Microsoft Excel - c:\progra~1\micros~3\office12\EXCEL.EXE/3000
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBC} - c:\program files\java\jre1.6.0_03\bin\ssv.dll
IE: {2670000A-7350-4f3c-8081-5663EE0C6C49} - {48E73304-E1D6-4330-914C-F5F514E3486C} - c:\progra~1\micros~3\office12\ONBttnIE.dll
IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~3\office12\REFIEBAR.DLL
DPF: {166B1BCA-3F9C-11CF-8075-444553540000} - hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - c:\progra~1\micros~3\office12\GR99D3~1.DLL
Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg9\avgpp.dll
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
AppInit_DLLs: avgrsstx.dll
SEH: Groove GFS Stub Execution Hook: {b5a7f190-dda6-4420-b3ba-52453494e6cd} - c:\progra~1\micros~3\office12\GRA8E1~1.DLL
mASetup: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "c:\program files\common files\lightscribe\LSRunOnce.exe"
Hosts: 127.0.0.1 www.spywareinfo.com

================= FIREFOX ===================

FF - ProfilePath - c:\users\young-~1\appdata\roaming\mozilla\firefox\profiles\pcueax30.default\
FF - prefs.js: browser.startup.homepage - hxxp://www.google.com/

—- FIREFOX POLICIES —-
c:\program files\mozilla firefox\greprefs\all.js - pref("ui.allow_platform_file_picker", true);
c:\program files\mozilla firefox\greprefs\all.js - pref("network.cookie.p3plevel", 1); // 0=low, 1=medium, 2=high, 3=custom
c:\program files\mozilla firefox\greprefs\all.js - pref("network.enablePad", false); // Allow client to do proxy autodiscovery
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.default", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.search.param.Google.1.custom", "chrome://branding/content/searchconfig.properties");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("signon.prefillForms", true);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.remoteLookups", false);
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.updateURL", "http://sb.google.com/safebrowsing/update?client={moz:client}&mozver={moz:version}-{moz:buildid}&");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.lookupURL", "http://sb.google.com/safebrowsing/lookup?sourceid=firefox-antiphish&features=TrustRank&client={moz:client}&mozver={moz:version}-{moz:buildid}&");
c:\program files\mozilla firefox\defaults\pref\firefox.js - pref("browser.safebrowsing.provider.0.reportURL", "http://sb.google.com/safebrowsing/report?");

============= SERVICES / DRIVERS ===============

R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2010-4-18 216200]
R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2010-4-18 29512]
R1 AvgTdiX;AVG Free Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2010-4-18 242696]
R2 avg9wd;AVG Free WatchDog;c:\program files\avg\avg9\avgwdsvc.exe [2010-4-18 308064]
R3 Bdfndisf;BitDefender Firewall NDIS Filter Service;c:\windows\system32\drivers\bdfndisf.sys [2008-5-17 86792]
S2 RpcLocatorwercplsupport;Remote Procedure Call (RPC) Locator RpcLocatorwercplsupport;c:\windows\system32\advpackm.exe srv –> c:\windows\system32\advpackm.exe srv [?]
S3 npggsvc;nProtect GameGuard Service;c:\windows\system32\gamemon.des -service –> c:\windows\system32\GameMon.des -service [?]

=============== Created Last 30 ================

2010-04-18 20:23:02 176 —-a-w- c:\users\young-jae\defogger_reenable
2010-04-18 06:23:29 0 d–h–w- C:\$AVG
2010-04-18 06:01:45 12464 —-a-w- c:\windows\system32\avgrsstx.dll
2010-04-18 06:01:42 242696 —-a-w- c:\windows\system32\drivers\avgtdix.sys
2010-04-18 06:01:31 216200 —-a-w- c:\windows\system32\drivers\avgldx86.sys
2010-04-18 06:01:07 0 d—–w- c:\windows\system32\drivers\Avg
2010-04-18 05:57:31 0 d—–w- c:\program files\AVG
2010-04-18 05:57:10 0 d—–w- c:\programdata\avg9
2010-04-17 07:04:33 0 d—–w- c:\program files\Heroes of Newerth
2010-04-16 09:26:25 2421760 —-a-w- c:\windows\system32\wucltux.dll
2010-04-16 09:26:00 87552 —-a-w- c:\windows\system32\wudriver.dll
2010-04-16 09:25:48 33792 —-a-w- c:\windows\system32\wuapp.exe
2010-04-16 09:25:48 171608 —-a-w- c:\windows\system32\wuwebv.dll
2010-04-16 05:35:21 0 d—–w- c:\programdata\SUPERAntiSpyware.com
2010-04-16 05:35:11 0 d—–w- c:\users\young-~1\appdata\roaming\SUPERAntiSpyware.com
2010-04-14 06:39:48 190 –s-a-w- c:\windows\system32\2410428209.dat
2010-04-07 01:05:52 0 d—–w- c:\program files\Wonderking
2010-04-01 04:01:06 0 d—–w- c:\program files\Gravity
2010-03-30 05:25:13 736386752 —-a-w- c:\windows\MEMORY.DMP

==================== Find3M ====================

2010-04-18 20:41:14 81984 —-a-w- c:\windows\system32\bdod.bin
2010-04-11 04:01:01 192963 —-a-w- c:\users\young-~1\appdata\roaming\nvModes.dat
2010-03-30 04:46:30 38224 —-a-w- c:\windows\system32\drivers\mbamswissarmy.sys
2010-03-30 04:45:52 20824 —-a-w- c:\windows\system32\drivers\mbam.sys
2010-03-24 04:43:47 99413 —-a-w- c:\windows\War3Unin.dat
2009-10-14 20:59:53 51200 —-a-w- c:\windows\inf\infpub.dat
2009-10-14 20:59:53 143360 —-a-w- c:\windows\inf\infstrng.dat
2009-10-14 20:59:53 143360 —-a-w- c:\windows\inf\infstor.dat
2009-10-14 20:47:40 665600 —-a-w- c:\windows\inf\drvindex.dat
2008-05-17 09:51:24 174 –sha-w- c:\program files\desktop.ini
2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfd.dat
2006-11-02 12:42:02 30674 —-a-w- c:\windows\inf\perflib\0409\perfc.dat
2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfi.dat
2006-11-02 12:42:02 287440 —-a-w- c:\windows\inf\perflib\0409\perfh.dat
2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfi.dat
2006-11-02 09:20:21 287440 —-a-w- c:\windows\inf\perflib\0000\perfh.dat
2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfd.dat
2006-11-02 09:20:19 30674 —-a-w- c:\windows\inf\perflib\0000\perfc.dat

============= FINISH: 16:42:25.85 ===============



GMER

GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-04-18 17:26:29
Windows 6.0.6002 Service Pack 2
Running: 5cdkhlml.exe; Driver: C:\Users\YOUNG-~1\AppData\Local\Temp\fgtdquob.sys


—- System - GMER 1.0.15 —-

SSDT \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys ZwOpenProcess [0x9D170B4C]
SSDT \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys ZwOpenThread [0x9D170C3A]
SSDT \??\C:\Program Files\BitDefender\BitDefender 2008\bdselfpr.sys ZwTerminateProcess [0x9D170AB0]

—- Kernel code sections - GMER 1.0.15 —-

.text ntkrnlpa.exe!KeSetEvent + 3F1 81EE0B34 4 Bytes [4C, 0B, 17, 9D] {DEC ESP; OR EDX, [EDI]; POPF }
.text ntkrnlpa.exe!KeSetEvent + 40D 81EE0B50 4 Bytes [3A, 0C, 17, 9D] {CMP CL, [EDI+EDX]; POPF }
.text ntkrnlpa.exe!KeSetEvent + 621 81EE0D64 4 Bytes [B0, 0A, 17, 9D] {MOV AL, 0xa; POP SS; POPF }
.rsrc C:\Windows\System32\drivers\mountmgr.sys entry point in ".rsrc" section [0x8071A014]
.text C:\Windows\system32\DRIVERS\nvlddmkm.sys section is writeable [0x8C00B360, 0x35B0A2, 0xE8000020]

—- User code sections - GMER 1.0.15 —-

.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtProtectVirtualMemory 77744D34 5 Bytes JMP 007E000A
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!NtWriteVirtualMemory 77745674 5 Bytes JMP 007F000A
.text C:\Windows\system32\svchost.exe[1328] ntdll.dll!KiUserExceptionDispatcher 77745DC8 5 Bytes JMP 0035000A
.text C:\Windows\system32\svchost.exe[1328] ole32.dll!CoCreateInstance 76589EA6 5 Bytes JMP 0154000A
.text C:\Windows\system32\svchost.exe[1328] USER32.dll!GetCursorPos 77890B88 5 Bytes JMP 0155000A
.text C:\Windows\Explorer.EXE[1784] ntdll.dll!NtProtectVirtualMemory 77744D34 5 Bytes JMP 0054000A
.text C:\Windows\Explorer.EXE[1784] ntdll.dll!NtWriteVirtualMemory 77745674 5 Bytes JMP 0055000A
.text C:\Windows\Explorer.EXE[1784] ntdll.dll!KiUserExceptionDispatcher 77745DC8 5 Bytes JMP 002E000A
.text C:\Program Files\Pando Networks\Media Booster\PMB.exe[3268] kernel32.dll!SetUnhandledExceptionFilter 762BA84F 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!SetScrollRange 7787D185 5 Bytes JMP 036DA6E3 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!GetScrollInfo 7787F073 7 Bytes JMP 036DA615 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!ShowScrollBar 7787F8AE 5 Bytes JMP 036DA711 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!SetScrollInfo 778871D8 7 Bytes JMP 036DA68D C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!EnableScrollBar 7789AF53 7 Bytes JMP 036DA5ED C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!GetScrollPos 778A337D 5 Bytes JMP 036DA63D C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!GetScrollRange 778A34A5 5 Bytes JMP 036DA662 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Winamp\winamp.exe[4160] USER32.dll!SetScrollPos 778A3602 5 Bytes JMP 036DA6B8 C:\Program Files\Winamp\Plugins\gen_jumpex.dll
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] ntdll.dll!NtProtectVirtualMemory 77744D34 5 Bytes JMP 0103000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] ntdll.dll!NtWriteVirtualMemory 77745674 5 Bytes JMP 0104000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] ntdll.dll!KiUserExceptionDispatcher 77745DC8 5 Bytes JMP 0102000A
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHCreateShellFolderView + B049 76AD2000 4 Bytes [91, 71, D0, 6F] {XCHG ECX, EAX; JNO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHCreateShellFolderView + B051 76AD2008 4 Bytes [9F, 70, D0, 6F] {LAHF ; JO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHCreateShellFolderView + B0BD 76AD2074 4 Bytes [91, 71, D0, 6F] {XCHG ECX, EAX; JNO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHCreateShellFolderView + B0C5 76AD207C 4 Bytes [9F, 70, D0, 6F] {LAHF ; JO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHCreateShellFolderView + B0F1 76AD20A8 4 Bytes [91, 71, D0, 6F] {XCHG ECX, EAX; JNO 0xffffffffffffffd3; OUTSD }
.text …
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!ILFree + 4A6 76B28EC8 4 Bytes [91, 71, D0, 6F] {XCHG ECX, EAX; JNO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!ILFree + 4AE 76B28ED0 8 Bytes [9F, 70, D0, 6F, 30, 72, D0, …] {LAHF ; JO 0xffffffffffffffd3; OUTSD ; XOR [EDX-0x30], DH; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHBindToObject + 298C 76B30A88 4 Bytes [91, 71, D0, 6F] {XCHG ECX, EAX; JNO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHBindToObject + 2994 76B30A90 4 Bytes [9F, 70, D0, 6F] {LAHF ; JO 0xffffffffffffffd3; OUTSD }
.text C:\Program Files\Mozilla Firefox\firefox.exe[5596] SHELL32.dll!SHBindToObject + 29A4 76B30AA0 4 Bytes [D6, 53, CE, 6F] {SALC ; PUSH EBX; INTO ; OUTSD }

—- Devices - GMER 1.0.15 —-

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 eabfiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Development Company, L.P.)
AttachedDevice \Driver\tdx \Device\Tcp bdftdif.sys
AttachedDevice \Driver\tdx \Device\Udp bdftdif.sys
AttachedDevice \Driver\tdx \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)

Device -> \Driver\atapi \Device\Harddisk0\DR0 84C09AC8

—- Registry - GMER 1.0.15 —-

Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x8B 0x60 0x35 0x96 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x3C 0x6B 0x60 0x2B …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC5 0x5A 0x77 0xA9 …
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41
Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x6E 0xC6 0x2E 0xDC …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x8B 0x60 0x35 0x96 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x3C 0x6B 0x60 0x2B …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xC5 0x5A 0x77 0xA9 …
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh 0x6E 0xC6 0x2E 0xDC …

—- Files - GMER 1.0.15 —-

File C:\Windows\System32\drivers\mountmgr.sys suspicious modification
File C:\Windows\system32\drivers\atapi.sys suspicious modification

—- EOF - GMER 1.0.15 —-📎Attach_1_.txt