Google Analytics and Redirect Virus?

My laptop (Lappy) is seriously infected. I'm very computer savy and I'm not sure where I've gone wrong. I know for sure I have the Google Redirect Virus because google redirects. Also something called Google Analytics is keeping from a lot of pages not loading. I have 3 anti virus programs and have tried this sites way of removing the virus but it just doesn't seem to work. Can anyone help?

Hello bitterbuffalo and welcome to WhatTheTech. Please follow these guidelines while we work on your PC:

• Malware removal is a sometimes lengthy and tedious process. Please stick with the thread until I’ve given you the “All clear.” Absence of symptoms does not mean your machine is clean!
• Please do not run any scans or install/uninstall any applications without being directed to do so.
• Please follow my instructions carefully and in the order they are posted.
• Any underlined text in my posts indicates a clickable link.
• You should print any instructions I give you for ease of use and reference.
• If you have any questions at all, please stop and ask before proceeding.

🖼Click to load external image (Posted Image) Please download DDS by sUBs from one of the following links and save it to your desktop.

DDS.scr
DDS.pif

• Disable any script blocking protection (How to Disable your Security Programs)
• Double click DDS icon to run the tool (may take up to 3 minutes to run)
• When done, DDS.txt will open.
• After a few moments, attach.txt will open in a second window.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and then click UPLOAD.

🖼Click to load external image (Posted Image) Download GMER Rootkit Scanner from here to your desktop.

• Double click the exe file. If asked to allow gmer.sys driver to load, please consent .
• If it gives you a warning about rootkit activity and asks if you want to run scan…click on NO.
  
  
  [external image: Posted Image]
  Click the image to enlarge it
  
  
  
• In the right panel, you will see several boxes that have been checked. Uncheck the following …
  • IAT/EAT
  • Drives/Partition other than Systemdrive (typically C:\)
  • Show All (don't miss this one)
• Then click the Scan button & wait for it to finish.
• Once done click on the [Save..] button, and in the File name area, type in "Gmer.txt" or it will save as a .log file which cannot be uploaded to your post.
  
• Save it where you can easily find it, such as your desktop, and post it in reply.

**Caution**
Rootkit scans often produce false positives. Do NOT take any action on any "<— ROOKIT" entries

If you have trouble running GEMR:

• Make sure that your security software is disabled
• Uncheck the box next to "Files" this time also
• If you still can't run it, try in the Safe Mode

Please include the following in your next post:

• DDS and Attach.txt logs
• GMER log

bitterbuffalo,

🖼Click to load external image (Posted Image) You are infected with a trojan know to sometimes have backdoor properties and a rootkit. Rootkits and Backdoor Trojans are very dangerous because they can steal sensitive information which they send back to the hacker. You should limit your online activity on this PC until it is cleaned. All passwords should be changed using a different computer and, if necessary, banking and credit card institutions should be notified of the possible security breach.

🖼Click to load external image (Posted Image) You have more than one antivirus (AV) program running. Your logs show both avast! and AVG running. Running more than one AV program does not offer any more protection and often causes conflicts and slow downs with your computer. Please uninstall either avast or AVG via Control Panel > Programs > Uninstall a Program. Run the removal tool (links below) for whichever app you uninstall also:

avast! Removal Tool
AVG Removal Tool

🖼Click to load external image (Posted Image) Please download Rootkit Unhooker and save it on your desktop.

• Disable your security programs
• Double click RKUnhookerLE.exe to run it
• Click the Report tab, then click Scan
• Check Drivers, Stealth Code, Files, and Code Hooks
• Uncheck the rest, then click OK
• When prompted to Select Disks for Scan, make sure C:\ is checked and click OK
• Wait till the scanner has finished then go File > Save Report
• Save the report somewhere you can find it. Click Close
• Copy the entire contents of the report and paste it in your next reply.

Note - You may get this warning it is ok, just ignore it:

"Rootkit Unhooker has detected a parasite inside itself!
It is recommended to remove parasite, okay?"

Please include the following in your next post:

• Rootkit Unhooker log

RkU Version: 3.8.388.590, Type LE (SR2) ============================================== OS Name: Windows 7 Version 6.1.7600 Number of processors #2 ============================================== >Drivers ============================================== 0x8DE2D000 C:\Windows\system32\DRIVERS\igdkmd32.sys 5230592 bytes (Intel Corporation, Intel Graphics Kernel Mode Driver) 0x82019000 C:\Windows\system32\DRIVERS\netw5v32.sys 4272128 bytes (Intel Corporation, Intel® Wireless WiFi Link Driver) 0x82A18000 C:\Windows\system32\ntkrnlpa.exe 4259840 bytes (Microsoft Corporation, NT Kernel & System) 0x82A18000 PnpManager 4259840 bytes 0x82A18000 RAW 4259840 bytes 0x82A18000 WMIxWDM 4259840 bytes 0x92A50000 Win32k 2400256 bytes 0x92A50000 C:\Windows\System32\win32k.sys 2400256 bytes (Microsoft Corporation, Multi-User Win32 Driver) 0x88C28000 C:\Windows\System32\drivers\tcpip.sys 1347584 bytes (Microsoft Corporation, TCP/IP Driver) 0x8883B000 C:\Windows\System32\Drivers\Ntfs.sys 1241088 bytes (Microsoft Corporation, NT File System Driver) 0x8E699000 C:\Windows\system32\DRIVERS\VSTDPV3.SYS 1056768 bytes (Conexant Systems, Inc., HSF_DP driver) 0x8E32A000 C:\Windows\System32\drivers\dxgkrnl.sys 749568 bytes (Microsoft Corporation, DirectX Graphics Kernel) 0x88A98000 C:\Windows\system32\drivers\ndis.sys 749568 bytes (Microsoft Corporation, NDIS 6.20 driver) 0x9200B000 C:\Windows\system32\DRIVERS\VSTCNXT3.SYS 741376 bytes (Conexant Systems, Inc., HSF_CNXT driver) 0x884D8000 C:\Windows\system32\CI.dll 700416 bytes (Microsoft Corporation, Code Integrity Module) 0x96D4F000 C:\Windows\system32\drivers\peauth.sys 618496 bytes (Microsoft Corporation, Protected Environment Authentication and Authorization Export Driver) 0x96C0E000 C:\Windows\system32\drivers\HTTP.sys 544768 bytes (Microsoft Corporation, HTTP Protocol Stack) 0x88405000 C:\Windows\system32\mcupdate_GenuineIntel.dll 491520 bytes (Microsoft Corporation, Intel Microcode Update Library) 0x88583000 C:\Windows\system32\drivers\Wdf01000.sys 462848 bytes (Microsoft Corporation, Kernel Mode Driver Framework Runtime) 0x982DA000 C:\Windows\system32\drivers\spsys.sys 434176 bytes (Microsoft Corporation, security processor) 0x8D993000 C:\Windows\system32\drivers\csc.sys 409600 bytes (Microsoft Corporation, Windows Client Side Caching Driver) 0x88A24000 C:\Windows\System32\Drivers\cng.sys 380928 bytes (Microsoft Corporation, Kernel Cryptography, Next Generation) 0x8D87C000 C:\Windows\system32\drivers\afd.sys 368640 bytes (Microsoft Corporation, Ancillary Function Driver for WinSock) 0x824E7000 C:\Windows\system32\DRIVERS\rixdptsk.sys 331776 bytes (REDC, RICOH XD SM Driver) 0x98263000 C:\Windows\System32\DRIVERS\srv.sys 331776 bytes (Microsoft Corporation, Server driver) 0x8CD88000 C:\Windows\system32\drivers\HdAudio.sys 327680 bytes (Microsoft Corporation, High Definition Audio Function Driver) 0x98214000 C:\Windows\System32\DRIVERS\srv2.sys 323584 bytes (Microsoft Corporation, Smb 2.0 Server driver) 0x92D00000 C:\Windows\System32\ATMFD.DLL 315392 bytes (Adobe Systems Incorporated, Windows NT OpenType/Type 1 Font Driver) 0x82437000 C:\Windows\system32\DRIVERS\USBPORT.SYS 307200 bytes (Microsoft Corporation, USB 1.1 & 2.0 Port Driver) 0x886EC000 C:\Windows\System32\drivers\volmgrx.sys 307200 bytes (Microsoft Corporation, Volume Manager Extension Driver) 0x8862A000 C:\Windows\system32\DRIVERS\ACPI.sys 294912 bytes (Microsoft Corporation, ACPI Driver for NT) 0x92189000 C:\Windows\system32\DRIVERS\nwifi.sys 286720 bytes (Microsoft Corporation, NativeWiFi Miniport Driver) 0x8CD33000 C:\Windows\system32\DRIVERS\usbhub.sys 278528 bytes (Microsoft Corporation, Default Hub Driver for USB) 0x88496000 C:\Windows\system32\CLFS.SYS 270336 bytes (Microsoft Corporation, Common Log File System Driver) 0x8D932000 C:\Windows\system32\DRIVERS\rdbss.sys 266240 bytes (Microsoft Corporation, Redirected Drive Buffering SubSystem Driver) 0x88DAB000 C:\Windows\system32\DRIVERS\volsnap.sys 258048 bytes (Microsoft Corporation, Volume Shadow Copy Driver) 0x88B4F000 C:\Windows\system32\drivers\NETIO.SYS 253952 bytes (Microsoft Corporation, Network I/O Subsystem) 0x8E65C000 C:\Windows\system32\DRIVERS\VSTAZL3.SYS 249856 bytes (Conexant Systems, Inc., HSF_HWAZL WDM driver) 0x96CE1000 C:\Windows\system32\DRIVERS\mrxsmb10.sys 241664 bytes (Microsoft Corporation, Longhorn SMB Downlevel SubRdr) 0x8CCA1000 C:\Windows\System32\drivers\dxgmms1.sys 233472 bytes (Microsoft Corporation, DirectX Graphics MMS) 0x82E28000 ACPI_HAL 225280 bytes 0x82E28000 C:\Windows\system32\halmacpi.dll 225280 bytes (Microsoft Corporation, Hardware Abstraction Layer DLL) 0x82550000 C:\Windows\system32\DRIVERS\SynTP.sys 225280 bytes (Synaptics Incorporated, Synaptics Touchpad Driver) 0x88797000 C:\Windows\system32\drivers\fltmgr.sys 212992 bytes (Microsoft Corporation, Microsoft Filesystem Filter Manager) 0x8CCF1000 C:\Windows\system32\DRIVERS\ks.sys 212992 bytes (Microsoft Corporation, Kernel CSA Library) 0x889A8000 C:\Windows\System32\DRIVERS\fvevol.sys 204800 bytes (Microsoft Corporation, BitLocker Drive Encryption Driver) 0x8D84A000 C:\Windows\System32\DRIVERS\netbt.sys 204800 bytes (Microsoft Corporation, MBT Transport driver) 0x88D71000 C:\Windows\System32\drivers\fwpkclnt.sys 200704 bytes (Microsoft Corporation, FWP/IPsec Kernel-Mode API) 0x8E614000 C:\Windows\system32\drivers\portcls.sys 192512 bytes (Microsoft Corporation, Port Class (Class Driver for Port/Miniport Devices)) 0x88BB2000 C:\Windows\System32\drivers\rdyboost.sys 184320 bytes (Microsoft Corporation, ReadyBoost Driver) 0x824A2000 C:\Windows\system32\DRIVERS\1394ohci.sys 180224 bytes (Microsoft Corporation, 1394 OpenHCI Driver) 0x8896A000 C:\Windows\System32\Drivers\msrpc.sys 176128 bytes (Microsoft Corporation, Kernel Remote Procedure Call Provider) 0x88683000 C:\Windows\system32\DRIVERS\pci.sys 172032 bytes (Microsoft Corporation, NT Plug and Play PCI Enumerator) 0x8CC3A000 C:\Windows\System32\Drivers\aswSP.SYS 159744 bytes (ALWIL Software, avast! self protection module) 0x982B4000 C:\Windows\System32\drivers\ipnat.sys 155648 bytes (Microsoft Corporation, IP Network Address Translator) 0x889DA000 C:\Windows\system32\DRIVERS\CLASSPNP.SYS 151552 bytes (Microsoft Corporation, SCSI Class System Dll) 0x88B8D000 C:\Windows\System32\Drivers\ksecpkg.sys 151552 bytes (Microsoft Corporation, Kernel Security Support Provider Interface Packages) 0x8876B000 C:\Windows\system32\DRIVERS\ataport.SYS 143360 bytes (Microsoft Corporation, ATAPI Driver Extension) 0x96CBE000 C:\Windows\system32\DRIVERS\mrxsmb.sys 143360 bytes (Microsoft Corporation, Windows NT SMB Minirdr) 0x8DE00000 C:\Windows\system32\DRIVERS\ndiswan.sys 139264 bytes (Microsoft Corporation, MS PPP Framing Driver (Strong Encryption)) 0x8E79B000 C:\Windows\System32\DRIVERS\srvnet.sys 135168 bytes (Microsoft Corporation, Server Network driver) 0x8CC61000 C:\Windows\system32\DRIVERS\tunnel.sys 135168 bytes (Microsoft Corporation, Microsoft Tunnel Interface Driver) 0x887DC000 C:\Windows\System32\drivers\VIDEOPRT.SYS 135168 bytes (Microsoft Corporation, Video Port Driver) 0x88800000 C:\Windows\system32\DRIVERS\cdrom.sys 126976 bytes (Microsoft Corporation, SCSI CD-ROM Driver) 0x8E3E1000 C:\Windows\system32\DRIVERS\HDAudBus.sys 126976 bytes (Microsoft Corporation, High Definition Audio Bus Driver) 0x8D8E2000 C:\Windows\system32\DRIVERS\pacer.sys 126976 bytes (Microsoft Corporation, QoS Packet Scheduler) 0x92CE0000 C:\Windows\System32\cdd.dll 122880 bytes (Microsoft Corporation, Canonical Display Driver) 0x9212A000 C:\Windows\system32\drivers\luafv.sys 110592 bytes (Microsoft Corporation, LUA File Virtualization Filter Driver) 0x96D1C000 C:\Windows\system32\DRIVERS\mrxsmb20.sys 110592 bytes (Microsoft Corporation, Longhorn SMB 2.0 Redirector) 0x9215F000 C:\Windows\system32\drivers\WudfPf.sys 106496 bytes (Microsoft Corporation, Windows Driver Foundation - User-mode Driver Framework Platform Driver) 0x96C93000 C:\Windows\system32\DRIVERS\bowser.sys 102400 bytes (Microsoft Corporation, NT Lan Manager Datagram Receiver Driver) 0x8E643000 C:\Windows\system32\drivers\drmk.sys 102400 bytes (Microsoft Corporation, Microsoft Trusted Audio Drivers) 0x824CE000 C:\Windows\system32\DRIVERS\sdbus.sys 102400 bytes (Microsoft Corporation, SecureDigital Bus Driver) 0x8CC14000 C:\Windows\System32\Drivers\dfsc.sys 98304 bytes (Microsoft Corporation, DFS Namespace Client Driver) 0x82538000 C:\Windows\system32\DRIVERS\i8042prt.sys 98304 bytes (Microsoft Corporation, i8042 Port Driver) 0x825C2000 C:\Windows\system32\DRIVERS\rasl2tp.sys 98304 bytes (Microsoft Corporation, RAS L2TP mini-port/call-manager driver) 0x825E5000 C:\Windows\system32\DRIVERS\raspppoe.sys 98304 bytes (Microsoft Corporation, RAS PPPoE mini-port/call-manager driver) 0x92145000 C:\Windows\system32\drivers\aswMonFlt.sys 94208 bytes (ALWIL Software, avast! File System Minifilter for Windows 2003/Vista) 0x82000000 C:\Windows\system32\DRIVERS\raspptp.sys 94208 bytes (Microsoft Corporation, Peer-to-Peer Tunneling Protocol) 0x8CCDA000 C:\Windows\system32\DRIVERS\rassstp.sys 94208 bytes (Microsoft Corporation, RAS SSTP Miniport Call Manager) 0x8D81E000 C:\Windows\system32\DRIVERS\tdx.sys 94208 bytes (Microsoft Corporation, TDI Translation Driver) 0x920CD000 C:\Windows\system32\DRIVERS\cdfs.sys 90112 bytes (Microsoft Corporation, CD-ROM File System Driver) 0x8874C000 C:\Windows\System32\drivers\mountmgr.sys 90112 bytes (Microsoft Corporation, Mount Point Manager) 0x88995000 C:\Windows\System32\Drivers\ksecdd.sys 77824 bytes (Microsoft Corporation, Kernel Security Support Provider Interface) 0x921DF000 C:\Windows\system32\DRIVERS\rspndr.sys 77824 bytes (Microsoft Corporation, Link-Layer Topology Responder Driver for NDIS 6) 0x8D90F000 C:\Windows\system32\DRIVERS\wanarp.sys 77824 bytes (Microsoft Corporation, MS Remote Access and Routing ARP Driver) 0x825B0000 C:\Windows\system32\DRIVERS\AgileVpn.sys 73728 bytes (Microsoft Corporation, RAS Agile Vpn Miniport Call Manager) 0x8CC82000 C:\Windows\system32\DRIVERS\intelppm.sys 73728 bytes (Microsoft Corporation, Processor Device Driver) 0x96CAC000 C:\Windows\System32\drivers\mpsdrv.sys 73728 bytes (Microsoft Corporation, Microsoft Protection Service Driver) 0x82491000 C:\Windows\system32\DRIVERS\bcm4sbxp.sys 69632 bytes (Broadcom Corporation, Broadcom Corporation NDIS 5.1 ethernet driver) 0x88BDF000 C:\Windows\system32\DRIVERS\disk.sys 69632 bytes (Microsoft Corporation, PnP Disk Driver) 0x92104000 C:\Windows\System32\Drivers\dump_dumpfve.sys 69632 bytes 0x887CB000 C:\Windows\system32\drivers\fileinfo.sys 69632 bytes (Microsoft Corporation, FileInfo Filter Driver) 0x8CD77000 C:\Windows\System32\Drivers\NDProxy.SYS 69632 bytes (Microsoft Corporation, NDIS Proxy) 0x886B8000 C:\Windows\System32\drivers\partmgr.sys 69632 bytes (Microsoft Corporation, Partition Management Driver) 0x8847D000 C:\Windows\system32\PSHED.dll 69632 bytes (Microsoft Corporation, Platform Specific Hardware Error Driver) 0x92179000 C:\Windows\system32\DRIVERS\lltdio.sys 65536 bytes (Microsoft Corporation, Link-Layer Topology Mapper I/O Driver) 0x88C00000 C:\Windows\System32\Drivers\mup.sys 65536 bytes (Microsoft Corporation, Multiple UNC Provider Driver) 0x921CF000 C:\Windows\system32\DRIVERS\ndisuio.sys 65536 bytes (Microsoft Corporation, NDIS User mode I/O driver) 0x8D922000 C:\Windows\system32\DRIVERS\termdd.sys 65536 bytes (Microsoft Corporation, Remote Desktop Server Driver) 0x886DC000 C:\Windows\system32\DRIVERS\volmgr.sys 65536 bytes (Microsoft Corporation, Volume Manager Driver) 0x82482000 C:\Windows\system32\DRIVERS\usbehci.sys 61440 bytes (Microsoft Corporation, EHCI eUSB Miniport Driver) 0x8CC2C000 C:\Windows\system32\DRIVERS\blbdrive.sys 57344 bytes (Microsoft Corporation, BLB Drive Driver) 0x8D901000 C:\Windows\system32\DRIVERS\netbios.sys 57344 bytes (Microsoft Corporation, NetBIOS interface driver) 0x8D810000 C:\Windows\System32\Drivers\Npfs.SYS 57344 bytes (Microsoft Corporation, NPFS Driver) 0x8873E000 C:\Windows\system32\DRIVERS\PCIIDEX.SYS 57344 bytes (Microsoft Corporation, PCI IDE Bus Driver Extension) 0x88A81000 C:\Windows\System32\drivers\pcw.sys 57344 bytes (Microsoft Corporation, Performance Counters for Windows Driver) 0x8CD25000 C:\Windows\system32\DRIVERS\umbus.sys 57344 bytes (Microsoft Corporation, User-Mode Bus Enumerator) 0x8861C000 C:\Windows\system32\drivers\WDFLDR.SYS 57344 bytes (Microsoft Corporation, Kernel Mode Driver Framework Loader) 0x825A3000 C:\Windows\system32\DRIVERS\CompositeBus.sys 53248 bytes (Microsoft Corporation, Multi-Transport Composite Bus Enumerator) 0x920E3000 C:\Windows\System32\Drivers\crashdmp.sys 53248 bytes (Microsoft Corporation, Crash Dump Driver) 0x82596000 C:\Windows\system32\DRIVERS\kbdclass.sys 53248 bytes (Microsoft Corporation, Keyboard Class Driver) 0x920C0000 C:\Windows\system32\drivers\modem.sys 53248 bytes (Microsoft Corporation, Modem Device Driver) 0x82589000 C:\Windows\system32\DRIVERS\mouclass.sys 53248 bytes (Microsoft Corporation, Mouse Class Driver) 0x96DF0000 C:\Windows\System32\drivers\tcpipreg.sys 53248 bytes (Microsoft Corporation, TCP/IP Registry Compatibility Driver) 0x8882B000 C:\Windows\System32\drivers\watchdog.sys 53248 bytes (Microsoft Corporation, Watchdog Driver) 0x8D987000 C:\Windows\System32\drivers\discache.sys 49152 bytes (Microsoft Corporation, System Indexer/Cache Driver) 0x8881F000 C:\Windows\System32\drivers\vga.sys 49152 bytes (Microsoft Corporation, VGA/Super VGA Video Driver) 0x886D1000 C:\Windows\system32\DRIVERS\BATTC.SYS 45056 bytes (Microsoft Corporation, Battery Class Driver) 0x920F0000 C:\Windows\System32\Drivers\dump_dumpata.sys 45056 bytes 0x9211F000 C:\Windows\system32\DRIVERS\monitor.sys 45056 bytes (Microsoft Corporation, Monitor Driver) 0x885F4000 C:\Windows\System32\Drivers\Msfs.SYS 45056 bytes (Microsoft Corporation, Mailslot driver) 0x825DA000 C:\Windows\system32\DRIVERS\ndistapi.sys 45056 bytes (Microsoft Corporation, NDIS 3.0 connection wrapper driver) 0x8D835000 C:\Windows\system32\DRIVERS\TDI.SYS 45056 bytes (Microsoft Corporation, TDI Wrapper) 0x8242C000 C:\Windows\system32\DRIVERS\usbuhci.sys 45056 bytes (Microsoft Corporation, UHCI USB Miniport Driver) 0x886AD000 C:\Windows\system32\DRIVERS\vdrvroot.sys 45056 bytes (Microsoft Corporation, Virtual Drive Root Enumerator) 0x8D840000 C:\Windows\System32\Drivers\aswTdi.SYS 40960 bytes (ALWIL Software, avast! TDI Filter Driver) 0x92115000 C:\Windows\System32\drivers\Dxapi.sys 40960 bytes (Microsoft Corporation, DirectX API Driver) 0x8D97D000 C:\Windows\system32\DRIVERS\mssmbios.sys 40960 bytes (Microsoft Corporation, System Management BIOS Driver) 0x8D973000 C:\Windows\system32\drivers\nsiproxy.sys 40960 bytes (Microsoft Corporation, NSI Proxy) 0x8DE22000 C:\Windows\system32\DRIVERS\rdpbus.sys 40960 bytes (Microsoft Corporation, Microsoft RDP Bus Device driver) 0x96DE6000 C:\Windows\System32\Drivers\secdrv.SYS 40960 bytes (Macrovision Corporation, Macrovision Europe Limited, and Macrovision Japan and Asia K.K., Macrovision SECURITY Driver) 0x8878E000 C:\Windows\system32\DRIVERS\amdxata.sys 36864 bytes (Advanced Micro Devices, Storage Filter Driver) 0x88762000 C:\Windows\system32\DRIVERS\atapi.sys 36864 bytes (Microsoft Corporation, ATAPI IDE Miniport Driver) 0x920FB000 C:\Windows\System32\Drivers\dump_atapi.sys 36864 bytes 0x88A8F000 C:\Windows\System32\Drivers\Fs_Rec.sys 36864 bytes (Microsoft Corporation, File System Recognizer Driver) 0x98344000 C:\Windows\System32\Drivers\Normandy.SYS 36864 bytes (RKU Driver) 0x92CB0000 C:\Windows\System32\TSDDD.dll 36864 bytes (Microsoft Corporation, Framebuffer Display Driver) 0x88DA2000 C:\Windows\system32\DRIVERS\vmstorfl.sys 36864 bytes (Microsoft Corporation, Virtual Storage Filter Driver) 0x8CC94000 C:\Windows\system32\DRIVERS\wmiacpi.sys 36864 bytes (Microsoft Corporation, Windows Management Interface for ACPI) 0x88672000 C:\Windows\system32\DRIVERS\WMILIB.SYS 36864 bytes (Microsoft Corporation, WMILIB WMI support library Dll) 0x8848E000 C:\Windows\system32\BOOTVID.dll 32768 bytes (Microsoft Corporation, VGA Boot Driver) 0x886C9000 C:\Windows\system32\DRIVERS\compbatt.sys 32768 bytes (Microsoft Corporation, Composite Battery Driver) 0x88C10000 C:\Windows\System32\drivers\hwpolicy.sys 32768 bytes (Microsoft Corporation, Hardware Policy Driver) 0x80BA3000 C:\Windows\system32\kdcom.dll 32768 bytes (Microsoft Corporation, Serial Kernel Debugger) 0x8867B000 C:\Windows\system32\DRIVERS\msisadrv.sys 32768 bytes (Microsoft Corporation, ISA Driver) 0x88600000 C:\Windows\System32\DRIVERS\RDPCDD.sys 32768 bytes (Microsoft Corporation, RDP Miniport) 0x88608000 C:\Windows\system32\drivers\rdpencdd.sys 32768 bytes (Microsoft Corporation, RDP Encoder Miniport) 0x88610000 C:\Windows\system32\drivers\rdprefmp.sys 32768 bytes (Microsoft Corporation, RDP Reflector Driver Miniport) 0x88DEA000 C:\Windows\System32\Drivers\spldr.sys 32768 bytes (Microsoft Corporation, loader for security processor) 0x88A18000 C:\Windows\System32\Drivers\Beep.SYS 28672 bytes (Microsoft Corporation, BEEP Driver) 0x88737000 C:\Windows\system32\DRIVERS\intelide.sys 28672 bytes (Microsoft Corporation, Intel PCI IDE Driver) 0x88A11000 C:\Windows\System32\Drivers\Null.SYS 28672 bytes (Microsoft Corporation, NULL Driver) 0x8D8DB000 C:\Windows\system32\DRIVERS\wfplwf.sys 28672 bytes (Microsoft Corporation, WFP NDIS 6.20 Lightweight Filter Driver) 0x8D8D6000 C:\Windows\System32\Drivers\aswRdr.SYS 20480 bytes (ALWIL Software, avast! TDI RDR Driver) 0x8CC9D000 C:\Windows\system32\DRIVERS\CmBatt.sys 16384 bytes (Microsoft Corporation, Control Method Battery Driver) 0x9215C000 C:\Windows\System32\Drivers\aswFsBlk.SYS 12288 bytes (ALWIL Software, avast! File System Access Blocking Driver) 0x82017000 C:\Windows\system32\DRIVERS\swenum.sys 8192 bytes (Microsoft Corporation, Plug and Play Software Device Enumerator) 0x82587000 C:\Windows\system32\DRIVERS\USBD.SYS 8192 bytes (Microsoft Corporation, Universal Serial Bus Driver) !!!!!!!!!!!Hidden driver: 0x858B0AEA ?_empty_? 1302 bytes 0x858B0EC5 unknown_irp_handler 315 bytes !!!!!!!!!!!Hidden driver: 0x85879D30 ?_empty_? 0 bytes ============================================== >Stealth ============================================== 0x88762000 WARNING: suspicious driver modification [atapi.sys::0x858B0AEA] ============================================== >Files ============================================== !–>[Hidden] C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_725C426D.exe_a12eb2e37191c869ffbd7283988e6641a2a5acd_cab_083a001f\Report.wer !–>[Hidden] C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_725C426D.exe_a12eb2e37191c869ffbd7283988e6641a2a5acd_cab_083a001f\WERF546.tmp.appcompat.txt !–>[Hidden] C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_725C426D.exe_a12eb2e37191c869ffbd7283988e6641a2a5acd_cab_083a001f\WERF5D4.tmp.WERInternalMetadata.xml !–>[Hidden] C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_725C426D.exe_a12eb2e37191c869ffbd7283988e6641a2a5acd_cab_083a001f\WERF5D5.tmp.hdmp !–>[Hidden] C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_725C426D.exe_a12eb2e37191c869ffbd7283988e6641a2a5acd_cab_083a001f\WERF836.tmp.mdmp !–>[Hidden] C:\Users\Kellie\AppData\Local\Temp\~DF84CD63D29F00BC2B.TMP::$DATA !–>[Hidden] C:\Users\Kellie\AppData\Local\Temp\~DFD43FF78B0DEA8BB7.TMP::$DATA !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\2ECFE17A9CBC0C01091A83AE422AA893_DF4020653102734F3C133B9DA89A2DD8 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\BD8A14C7C024625432CC03FE72E47EF0_334C201686715F64B22A9E2F3348385D !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\D5D8E3E1D876646A16C22BC0C8C5181A_6CD083BF48A69468FD0994D5F5CCEF65 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\E0368BD38F9E8E14978A5E6E94D1ECDF !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\2ECFE17A9CBC0C01091A83AE422AA893_DF4020653102734F3C133B9DA89A2DD8 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\BD8A14C7C024625432CC03FE72E47EF0_334C201686715F64B22A9E2F3348385D !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\D5D8E3E1D876646A16C22BC0C8C5181A_6CD083BF48A69468FD0994D5F5CCEF65 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\E0368BD38F9E8E14978A5E6E94D1ECDF !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\10e5f8f69-e1d0-4609-9d36-0787b8108c1a@x90[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\1660884528@x96[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\460120696[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\adifyExelatePixelFreqIF[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\ad[2].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\ai_realmedia_com[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\ajs[7].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\data_sync[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\dref=http%253A%252F%252Fb.localpages.com%252Fbanner[1].php%253Faffiliate%253Dlocalpages%2526style%253D2%2526size%253D160x600 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\eas[1] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\imp[9] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\mmmss[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\9N7UUGZF\text_group[3].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\01&1481893608[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\01&2116389133[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\01[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\03409c1a[1].txt !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\11510925084@x23[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\1792067271@x23[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\774497937@x94[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\ajs[7].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\banner[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\banner[2].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\banner[3].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\banner[4].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\banner[5].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\blakroc-webisode-9-feat-pharoahe-monch[1].txt !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\cms-2-frame[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\eas[1] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\if[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\log[1] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\mmmss[3].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\mmtnt[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\mmtnt[2].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\results-lp[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\services[2].xml !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\services[3].xml !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\text_group[3].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\two[4].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\EIG2BN81\usersync[1] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\01[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\1[timestamp]@x90[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\1[timestamp]@x90[2].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\adservercontinuation[1].aspx !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\ad[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\ajs[5].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\atf[1] !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\atf[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\iframe3[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\impCAUT3THL !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\indexCARBQCAF.php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\text_group[5].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\G07VMG88\two[10].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYL35N7C\6referrer%253Dhttp%253A%252F%252Fb.localpages.com%252Fbanner[1].php%25253Faffiliate%253Dlocalpages%252526style%253D2%252526size%253D300x250 !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYL35N7C\ai_realmedia_com[1].htm !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYL35N7C\banner[1].php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\OYL35N7C\indexCAMEYQCC.php !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@adap[1].txt !–>[Hidden] C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\Cookies\system@liveperson[1].txt ============================================== >Hooks ============================================== ntkrnlpa.exe+0x00222C5F, Type: Inline - RelativeJump 0x82C3AC5F–>8CC4CFD2 [aswSP.SYS] ntkrnlpa.exe–>NtCreateProcessEx, Type: Inline - RelativeJump 0x82CF2E52–>8CC4FBA0 [aswSP.SYS] ntkrnlpa.exe–>NtCreateSection, Type: Inline - RelativeJump 0x82C48CE3–>8CC4F9C4 [aswSP.SYS] ntkrnlpa.exe–>ObMakeTemporaryObject, Type: Inline - RelativeJump 0x82C20F59–>8CC4B5B4 [aswSP.SYS] [1020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [1020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [1020]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [1020]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [1020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [1020]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [1024]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [1024]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [1024]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [1024]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [1024]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [1044]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [1044]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [1044]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [1044]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [1044]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [2468]iexplore.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [2468]iexplore.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [2468]iexplore.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [2468]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [2468]iexplore.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [2468]iexplore.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [2468]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump 0x762BCC8F–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x762C0E51–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x762FD29C–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x762E4AA7–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x762FCF6A–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x762E564A–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7630EA29–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7630EA4D–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7630E8C9–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7630E9C3–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump 0x762C210A–>00000000 [ieframe.dll] [2468]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump 0x762BCC7B–>00000000 [ieframe.dll] [2556]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [2556]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [2556]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [2556]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [2556]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [2556]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [2580]explorer.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [2580]explorer.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [2580]explorer.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [2580]explorer.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [2580]explorer.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [2580]explorer.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [2668]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [2668]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [2668]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [2668]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [2668]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [2668]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [2772]firefox.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [2772]firefox.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [2772]firefox.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [2772]firefox.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [2772]firefox.exe–>ntdll.dll–>LdrLoadDll, Type: Inline - RelativeJump 0x7702F585–>00000000 [firefox.exe] [2772]firefox.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [2772]firefox.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [2848]iexplore.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [2848]iexplore.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [2848]iexplore.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [2848]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [2848]iexplore.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [2848]iexplore.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [2848]iexplore.exe–>user32.dll–>CallNextHookEx, Type: Inline - RelativeJump 0x762BCC8F–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x762C0E51–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x762FD29C–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x762E4AA7–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x762FCF6A–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x762E564A–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7630EA29–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7630EA4D–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7630E8C9–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7630E9C3–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>SetWindowsHookExW, Type: Inline - RelativeJump 0x762C210A–>00000000 [ieframe.dll] [2848]iexplore.exe–>user32.dll–>UnhookWindowsHookEx, Type: Inline - RelativeJump 0x762BCC7B–>00000000 [ieframe.dll] [3212]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [3212]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [3212]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [3212]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [3212]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [3212]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [3412]iexplore.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [3412]iexplore.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [3412]iexplore.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [3412]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [3412]iexplore.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [3412]iexplore.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [3412]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x762C0E51–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x762FD29C–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x762E4AA7–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x762FCF6A–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x762E564A–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7630EA29–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7630EA4D–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7630E8C9–>00000000 [ieframe.dll] [3412]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7630E9C3–>00000000 [ieframe.dll] [3520]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [3520]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [3520]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [3520]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [3520]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [3520]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [4020]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [4020]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [4020]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [4020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [4020]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [4088]iexplore.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [4088]iexplore.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [4088]iexplore.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [4088]iexplore.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [4088]iexplore.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [4088]iexplore.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [4088]iexplore.exe–>user32.dll–>CreateWindowExW, Type: Inline - RelativeJump 0x762C0E51–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>DialogBoxIndirectParamA, Type: Inline - RelativeJump 0x762FD29C–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>DialogBoxIndirectParamW, Type: Inline - RelativeJump 0x762E4AA7–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>DialogBoxParamA, Type: Inline - RelativeJump 0x762FCF6A–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>DialogBoxParamW, Type: Inline - RelativeJump 0x762E564A–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>MessageBoxExA, Type: Inline - RelativeJump 0x7630EA29–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>MessageBoxExW, Type: Inline - RelativeJump 0x7630EA4D–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>MessageBoxIndirectA, Type: Inline - RelativeJump 0x7630E8C9–>00000000 [ieframe.dll] [4088]iexplore.exe–>user32.dll–>MessageBoxIndirectW, Type: Inline - RelativeJump 0x7630E9C3–>00000000 [ieframe.dll] [768]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77C6178C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77C617F0–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77C61848–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77C617B8–>00000000 [apphelp.dll] [768]esentutlb.exe–>advapi32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x77C61844–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x00407020–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x00407018–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x00407010–>00000000 [AcGenral.dll] [768]esentutlb.exe–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x00407004–>00000000 [AcGenral.dll] [768]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x77B61154–>00000000 [AcGenral.dll] [768]esentutlb.exe–>gdi32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77B611E0–>00000000 [AcGenral.dll] [768]esentutlb.exe–>gdi32.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x77B6118C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>gdi32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77B611B8–>00000000 [apphelp.dll] [768]esentutlb.exe–>kernel32.dll–>CopyFileA, Type: IAT modification 0x0040709C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>CreateFileA, Type: IAT modification 0x004070D4–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>CreateProcessA, Type: IAT modification 0x004070CC–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x00407144–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>GetFileAttributesA, Type: IAT modification 0x00407078–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x00407114–>00000000 [apphelp.dll] [768]esentutlb.exe–>kernel32.dll–>MoveFileA, Type: IAT modification 0x00407070–>00000000 [AcGenral.dll] [768]esentutlb.exe–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x00407084–>00000000 [AcGenral.dll] [768]esentutlb.exe–>shell32.dll–>kernel32.dll–>CopyFileW, Type: IAT modification 0x738022B8–>00000000 [AcGenral.dll] [768]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x73802240–>00000000 [AcGenral.dll] [768]esentutlb.exe–>shell32.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x7380228C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>user32.dll–>ExitWindowsEx, Type: IAT modification 0x00407224–>00000000 [AcGenral.dll] [768]esentutlb.exe–>user32.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x77D11524–>00000000 [AcGenral.dll] [768]esentutlb.exe–>user32.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x77D114E0–>00000000 [apphelp.dll] [768]esentutlb.exe–>user32.dll–>kernel32.dll–>RegCreateKeyExW, Type: IAT modification 0x77D114B4–>00000000 [AcGenral.dll] [768]esentutlb.exe–>user32.dll–>kernel32.dll–>RegOpenKeyExW, Type: IAT modification 0x77D11444–>00000000 [AcGenral.dll] [768]esentutlb.exe–>user32.dll–>kernel32.dll–>RegSetValueExW, Type: IAT modification 0x77D114AC–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExA, Type: IAT modification 0x71201284–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegCreateKeyExW, Type: IAT modification 0x712011D0–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueA, Type: IAT modification 0x71201244–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegDeleteValueW, Type: IAT modification 0x712011D8–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExA, Type: IAT modification 0x7120128C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegOpenKeyExW, Type: IAT modification 0x71201268–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExA, Type: IAT modification 0x71201288–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>advapi32.dll–>RegSetValueExW, Type: IAT modification 0x712011DC–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>CopyFileA, Type: IAT modification 0x712012DC–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileA, Type: IAT modification 0x712014CC–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>CreateFileW, Type: IAT modification 0x712014D0–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileA, Type: IAT modification 0x712014F4–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>DeleteFileW, Type: IAT modification 0x71201448–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>GetProcAddress, Type: IAT modification 0x7120144C–>00000000 [apphelp.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileA, Type: IAT modification 0x71201318–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExA, Type: IAT modification 0x71201444–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileExW, Type: IAT modification 0x71201310–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>MoveFileW, Type: IAT modification 0x71201314–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesA, Type: IAT modification 0x7120132C–>00000000 [AcGenral.dll] [768]esentutlb.exe–>wininet.dll–>kernel32.dll–>SetFileAttributesW, Type: IAT modification 0x71201400–>00000000 [AcGenral.dll] [944]svchost.exe–>mswsock.dll+0x00002BBC, Type: Inline - RelativeJump 0x74B62BBC–>00000000 [unknown_code_page] [944]svchost.exe–>mswsock.dll+0x000044B1, Type: Inline - RelativeJump 0x74B644B1–>00000000 [unknown_code_page] [944]svchost.exe–>mswsock.dll+0x000046B7, Type: Inline - RelativeJump 0x74B646B7–>00000000 [unknown_code_page] [944]svchost.exe–>ntdll.dll–>KiUserExceptionDispatcher, Type: Inline - RelativeJump 0x77016448–>00000000 [unknown_code_page] [944]svchost.exe–>ntdll.dll–>NtProtectVirtualMemory, Type: Inline - RelativeJump 0x77015360–>00000000 [unknown_code_page] [944]svchost.exe–>ntdll.dll–>NtWriteVirtualMemory, Type: Inline - RelativeJump 0x77015EE0–>00000000 [unknown_code_page] [944]svchost.exe–>user32.dll–>GetCursorPos, Type: Inline - RelativeJump 0x762BC198–>00000000 [unknown_code_page]

bitterbuffalo,

🖼Click to load external image (Posted Image) Download Combofix from either of the links below, and save it to your desktop.

Link 1
Link 2

**Note: It is important that it is saved directly to your desktop**

——————————————————————–
IMPORTANT - Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link here
——————————————————————–

Double click on ComboFix.exe & follow the prompts.

• When finished, it will produce a report for you.
• Please post the C:\ComboFix.txt.

Please include the following in your next post:

• ComboFix log

bitterbuffalo,

🖼Click to load external image (Posted Image) P2P - I see you have P2P software (uTorrent) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to malware infections. Malware authors use P2P filesharing as a major conduit to spread their wares. I would strongly recommend that you uninstall these now. You can do so via Control Panel >> Add or Remove Programs. If you choose to keep these applications, please do not use them until our fixes at WTT are complete.

🖼Click to load external image (Posted Image) Open Notepad Go to Start> All Programs> Accessories> Notepad ( this will only work with Notepad ) and copy all the text inside the Codebox by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above http://

http://forums.whatthetech.com/index.php?showtopic=113613
Collect::
c:\windows\system32\FastUv32.dll

Save this as CFScript to your desktop.

Then disable your security programs and drag the CFScript into ComboFix.exe as you see in the screenshot below.

[external image: Posted Image]


This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

🖼Click to load external image (Posted Image) You have this program installed, Malwarebytes' Anti-Malware (MBAM). Please update it and run a scan.

Open MBAM

• Click the Update tab
• Click Check for Updates
• If an update is found, it will download and install the latest version.
• The program will close to update and reopen.
• Once the program has loaded, select "Perform Quick Scan", then click Scan.
• The scan may take some time to finish,so please be patient.
• When the scan is complete, click OK, then Show Results to view the results.
• Make sure that everything is checked, and click Remove Selected.
• When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
• The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
• Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Please include the following in your next post:

• ComboFix log
• MBAM log

Hi bitterbuffalo,

How is you computer running? Please run this for me now:

🖼Click to load external image (Posted Image) Using Internet Explorer or Firefox, visit Kaspersky Online Scanner

1. Click Accept, when prompted to download and install the program files and database of malware definitions.

2. To optimize scanning time and produce a more sensible report for review:

• Close any open programs
• Turn off the real time scanner of any existing antivirus program while performing the online scan. Click HERE to see how to disable the most common antivirus programs.

3. Click Run at the Security prompt.

The program will then begin downloading and installing and will also update the database.
Please be patient as this can take quite a long time to download.

• Once the update is complete, click on Settings.
• Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button:
  • Spyware, adware, dialers, and other riskware
  • Archives
  • E-mail databases
• Click on My Computer under the green Scan bar to the left to start the scan.
• Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
• Do NOT be alarmed by what you see in the report. Many of the finds have likely been quarantined.
• Click View report… at the bottom.
• Click the Save report… button.
• Change the Files of type dropdown box to Text file (.txt) and name the file KasReport.txt to save the file to your desktop so that you may post it in your next reply

Please include the following in your next post:

• Kaspersky log

——————————————————————————– KASPERSKY ONLINE SCANNER 7.0: scan report Wednesday, August 4, 2010 Operating system: Microsoft Professional (build 7600) Kaspersky Online Scanner version: 7.0.26.13 Last database update: Tuesday, August 03, 2010 19:48:01 Records in database: 4147105 ——————————————————————————– Scan settings: scan using the following database: extended Scan archives: yes Scan e-mail databases: yes Scan area - My Computer: C:\ D:\ Scan statistics: Objects scanned: 85892 Threats found: 2 Infected objects found: 3 Suspicious objects found: 0 Scan duration: 03:44:07 File name / Threat / Threats count C:\Qoobox\Quarantine\C\Windows\system32\Drivers\csc.sys.vir Infected: Rootkit.Win32.TDSS.ap 1 C:\Qoobox\Quarantine\[4]-Submit_2010-08-03_09.55.26.zip Infected: Backdoor.Win32.Agent.axqe 1 C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7600.16385_none_9e1e9f0abd3adf87\csc.sys Infected: Rootkit.Win32.TDSS.ap 1 Selected area has been scanned.

bitterbuffalo,

Click Start > Run or Press Windows Key + R and copy/paste the following single-line command into the Run box and click OK:

cmd /c del /f/a/q "C:\Windows\winsxs\x86_microsoft-windows-offlinefiles-core_31bf3856ad364e35_6.1.7600.16385_none_9e1e9f0abd3adf87\csc.sys"

Now all that's left to do is some very important cleanup:

🖼Click to load external image (Posted Image) Uninstall ComboFix

• Press the Windows key + R on your keyboard or click Start -> Run. Copy and past the following text into the run box that opens and press OK:
  Combofix /Uninstall

🖼Click to load external image (Posted Image)

🖼Click to load external image (Posted Image) Delete the following tools along with any other logs you saved from our work:

• DDS
• GMER
• Rootkit Unhooker

🖼Click to load external image (Posted Image) Finally, I'd like to make a couple of suggestions to help you stay clean in the future:

• Restart any anti-malware programs that we disabled while we were cleaning your machine.
• Keep your antivirus application current and updated. Also, hang on to MBAM. Scan with them at least weekly.
• Avoid using P2P programs. Refer back to my earlier post for more information.
• Consider running in a limited user account. See this post for more information.
• Please carefully review the information in our Security - Best Practices and Prevention forum located HERE

Please post once more so I know you are all set and I can close this thread. Good luck and stay safe!

I seem to be all set. Lappy is running much better! Thank you for all your help.

You're welcome. Take care.

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please follow the instructions here http://forums.whatthetech.com/you_Infected_t106388.html
and start a New Topic.