Pomocy-Rootkit jako pożeracz RAM

Broda23 · 5 Czerwiec 2007 06:07

Szukam niewidzialnego szkodnika. Podpina się pod svchost.exe, który zamiast 20MB pożera 60-80 MB RAM. Efekt to brak odpowiedzi na polecenia myszy a następnie nagłe otwieranie tej samej aplikacji w 3 -krotnym powtórzeniu. Wyczyściłem wszystko co się dało za pomocą Noda32 Ksperskiego i a-squaed Free 2,1. Znalazł i oraz w C:\WINDOWS\system32\sstnnst3.exe. Trochę ulżyło ale system dalej kuleje. Zastosowałem Sophos Anti Rootkit 1,3 który po 2 nieudanych skanach, zakończonych alarmem o krytycznym błędzie wykazał istnienie zewnętrznych USERÓW. np. w aplikacji C:\PROGRA~~1\WINDOW~2\wmplayer.exe . Proszę o sprawdzenie loga z HijackThis 1.99.1

Logfile of HijackThis v1.99.1 Scan saved at 07:14:45, on 2007-06-05 Platform: Windows XP Dodatek SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\SYSTEM32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe G:\PROGRA~1\CACHEM~1\CachemanXP.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe G:\Program Files\Eset\nod32krn.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\System32\nvsvc32.exe G:\Program Files\Sunbelt Software\kpf4ss.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Canon\CAL\CALMAIN.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\Common Files\Real\Update_OB\realsched.exe G:\Program Files\Eset\nod32kui.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe G:\Program Files\Sunbelt Software\kpf4gui.exe G:\Program Files\Sunbelt Software\kpf4gui.exe C:\WINDOWS\system32\wuauclt.exe G:\Odebrane pliki1\AntyRootkity\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://szukaj.wp.pl R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.eu.microsoft.com/poland/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Neostrada TP R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Łącza R3 - URLSearchHook: Search Class - {08C06D61-F1F3-4799-86F8-BE1A89362C85} - (no file) O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file) O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - G:\Program Files\Spybot - Search & Destroy\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll O4 - HKLM…\Run: [soundMan] SOUNDMAN.EXE O4 - HKLM…\Run: [NvCplDaemon] “RUNDLL32.EXE” NvQTwk,NvCplDaemon initialize O4 - HKLM…\Run: [nwiz] “nwiz.exe” /install O4 - HKLM…\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe O4 - HKLM…\Run: [TkBellExe] “C:\Program Files\Common Files\Real\Update_OB\realsched.exe” -osboot O4 - HKLM…\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM…\Run: [nod32kui] “G:\Program Files\Eset\nod32kui.exe” /WAITSERVICE O4 - HKCU…\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU…\Run: [updateMgr] “G:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” AcRdB0_0_0 -reboot 1 O4 - HKCU…\Run: [Odkurzacz-MCD] G:\Program Files\Odkurzacz\odk_mcd.exe O4 - Global Startup: DSLMON.lnk = C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O9 - Extra button: Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra ‘Tools’ menuitem: Windows Messenger - -{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra ‘Tools’ menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll O9 - Extra button: Badanie - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - G:\PROGRA~1\MICROS~1\OFFICE11\REFIEBAR.DLL O16 - DPF: ING Bank Online - https://ssl.bsk.com.pl/bskonl/component/INGOnl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftup … 9733246041 O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: CachemanXP (CachemanXPService) - OuterTechnologies - G:\PROGRA~1\CACHEM~1\CachemanXP.exe O23 - Service: Canon Camera Access Library 8 (CCALib8) - Canon Inc. - C:\Program Files\Canon\CAL\CALMAIN.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: ipfw_helper (ipfw) - Unknown owner - G:\Program Files\MCS Studios\MCS Firewall 6\system\ipfw.exe (file missing) O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - G:\Program Files\Eset\nod32krn.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Sunbelt Personal Firewall 4 (SPF4) - Sunbelt Software - G:\Program Files\Sunbelt Software\kpf4ss.exe

Z góry dziękuję i pozdrawiam forumowiczów, od których wiele się nauczyłem.

Phylby · 5 Czerwiec 2007 07:16

Pod który svchost.exe ?? W systemie jet ich wiele.

Wklej jeszcze logi z :

Silent Runners oraz z programu Gmer:

http://forum.dobreprogramy.pl/viewtopic … hp?lang=pl

http://forum.dobreprogramy.pl/viewtopic.php?t=101848

http://www.searchengines.pl/phpbb203/in … wforum=152

Czekaj na speców.

Gutek · 5 Czerwiec 2007 13:41

usuń wpisy HJT, daj log z Combofix

Broda23 · 5 Czerwiec 2007 16:03

Svchost.exe wystepuje kilkakrotnie. Nie ma sensu nzywać go 4 od góry na liście Cacheman XP. Ważniejsze jest to, że jaklo jedyny z grupy zuzywa zawsze najwięcej RAM(Ok. 20MB przy normalnym zachowaniu) Pozostałe mieszczą się w przedziale 0,4-5 MB. Korzystając z waszych rad wykonałem kilka logów, które wklejam poniżej.

I. Combofix

“Pan” - 2007-06-05 8:38:14 Dodatek Service Pack 2 ComboFix 07-06-3 - Running from: “G:\Odebrane pliki1\AntyRootkity” ((((((((((((((((((((((((( Files Created from 2007-05-05 to 2007-06-05 ))))))))))))))))))))))))))))))) 2007-06-04 21:56 2007-06-03 22:01 2007-06-03 21:57 2007-06-02 19:43 2007-06-02 19:30 55,904 --a------ C:\WINDOWS\system32\drivers\pctfw.sys 2007-05-29 20:51 2007-05-29 19:55 2007-05-29 15:18 6,152,192 --a------ C:\DOCUME~1\Pan\ntuser.dat 2007-05-25 14:49 512,096 --a------ C:\WINDOWS\system32\drivers\amon.sys 2007-05-25 14:49 298,104 --a------ C:\WINDOWS\system32\imon.dll 2007-05-25 14:49 15,424 --a------ C:\WINDOWS\system32\drivers\nod32drv.sys 2007-05-06 16:54 (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-05-26 17:46:16 4,212 —h–w C:\WINDOWS\system32\zllictbl.dat 2007-05-18 16:03:46 107,132 ----a-w C:\WINDOWS\UninstallFirefox.exe 2007-05-18 16:03:42 12,312 ----a-w C:\WINDOWS\mozver.dat 2007-04-26 08:21:34 72,624 ----a-w C:\WINDOWS\system32\drivers\khips.sys 2007-04-26 08:21:30 302,000 ----a-w C:\WINDOWS\system32\drivers\fwdrv.sys 2007-03-17 13:45:36 293,376 ----a-w C:\WINDOWS\system32\winsrv.dll 2007-03-08 15:38:48 579,072 ----a-w C:\WINDOWS\system32\user32.dll 2007-03-08 15:38:48 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll 2007-03-08 15:38:48 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll 2007-03-08 15:37:34 1,843,840 ----a-w C:\WINDOWS\system32\win32k.sys ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) *Note* empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects] {53707962-6F74-2D53-2644-206D7942484F}=G:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04] {761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll [2006-11-09 15:21] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “SoundMan”=“SOUNDMAN.EXE” [2002-07-12 06:17 C:\WINDOWS\SOUNDMAN.EXE] “NvCplDaemon”=“RUNDLL32.exe” [2004-08-04 00:44 C:\WINDOWS\system32\rundll32.exe] “nwiz”=“nwiz.exe” [2002-09-19 08:10 C:\WINDOWS\system32\nwiz.exe] “TkBellExe”=“C:\Program Files\Common Files\Real\Update_OB\realsched.exe” [2007-02-10 19:43] “nod32kui”=“G:\Program Files\Eset\nod32kui.exe” [2007-06-03 21:45] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] “ctfmon.exe”=“C:\WINDOWS\system32\ctfmon.exe” [2004-08-04 00:44] “updateMgr”=“G:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe” [2005-08-18 19:49] “Odkurzacz-MCD”=“G:\Program Files\Odkurzacz\odk_mcd.exe” [2007-05-03 10:02] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD] C:\Program Files\Ahead\InCD\InCD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype] “C:\Program Files\Skype\Phone\Skype.exe” /nosplash /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spyware Doctor] “G:\Program Files\Spyware Doctor\swdoctor.exe” /Q HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs* ************************************************************************** catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net Rootkit scan 2007-06-05 08:41:22 Windows 5.1.2600 Dodatek Service Pack 2 FAT NTAPI scanning hidden processes … ? [3000] scanning hidden autostart entries … scanning hidden files … scan completed successfully hidden files: 0 ************************************************************************** Files hidden from API: C:\WINDOWS\BĄbelki.bmp C:\WINDOWS\system32\Pokaľ kanay.scf Completion time: 2007-06-05 8:43:58 — E O F —

II log gmer

GMER 1.0.12.12244 - http://www.gmer.net Rootkit scan 2007-06-05 16:22:52 Windows 5.1.2600 Dodatek Service Pack 2 ---- System - GMER 1.0.12 ---- SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwClose SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcess SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateProcessEx SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwCreateThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwDeleteValueKey SSDT \SystemRoot\system32\drivers\khips.sys ZwLoadDriver SSDT \SystemRoot\system32\drivers\khips.sys ZwMapViewOfSection SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwOpenKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwResumeThread SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetInformationFile SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwSetValueKey SSDT \SystemRoot\system32\drivers\fwdrv.sys ZwWriteFile INT 0x06 ??\C:\WINDOWS\System32\drivers\Haspnt.sys F412116D INT 0x0E ??\C:\WINDOWS\System32\drivers\Haspnt.sys F4120FC2 ---- Kernel code sections - GMER 1.0.12 ---- PAGENDSM NDIS.sys!NdisMIndicateStatus F9ADAA5F 6 Bytes JMP F46A9C5E \SystemRoot\system32\drivers\fwdrv.sys ? C:\WINDOWS\System32\DRIVERS\update.sys ---- User code sections - GMER 1.0.12 ---- .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text C:\Program Files\Canon\CAL\CALMAIN.exe[140] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text C:\Program Files\SAGEM\SAGEM F@st 800-840\dslmon.exe[312] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001601A8 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00160090 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00160694 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessW 7C802332 5 Bytes JMP 001602C0 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessA 7C802367 5 Bytes JMP 00160234 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00160004 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0016011C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001604F0 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateThread 7C810637 5 Bytes JMP 0016057C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001603D8 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0016034C .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!WinExec 7C86136D 5 Bytes JMP 00160464 .text C:\WINDOWS\system32\csrss.exe[444] KERNEL32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00160608 .text C:\WINDOWS\system32\csrss.exe[444] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001607AC .text C:\WINDOWS\system32\csrss.exe[444] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00160720 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000701A8 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00070090 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00070694 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000702C0 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00070234 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00070004 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0007011C .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 000704F0 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0007057C .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 000703D8 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0007034C .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00070464 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00070608 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 000707AC .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00070720 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000708C4 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00070838 .text C:\WINDOWS\SYSTEM32\winlogon.exe[476] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00070950 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\svchost.exe[908] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\svchost.exe[908] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\svchost.exe[908] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetOpenW 771AAEFD 5 Bytes JMP 00080DB0 .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetConnectA 771B30C3 5 Bytes JMP 00080F54 .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetOpenA 771B58BA 5 Bytes JMP 00080D24 .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetOpenUrlA 771B5B6D 5 Bytes JMP 00080E3C .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetConnectW 771BEE00 5 Bytes JMP 00080FE0 .text C:\WINDOWS\system32\svchost.exe[908] WININET.dll!InternetOpenUrlW 771C5B52 5 Bytes JMP 00080EC8 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00080004 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0008011C .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 000804F0 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0008057C .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 000803D8 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0008034C .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00080464 .text C:\WINDOWS\system32\spoolsv.exe[1100] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00080608 .text C:\WINDOWS\system32\spoolsv.exe[1100] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 000807AC .text C:\WINDOWS\system32\spoolsv.exe[1100] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00080720 .text C:\WINDOWS\system32\spoolsv.exe[1100] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\system32\spoolsv.exe[1100] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\system32\spoolsv.exe[1100] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text G:\Program Files\Eset\nod32krn.exe[1476] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text G:\Program Files\Eset\nod32krn.exe[1476] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text G:\Program Files\Eset\nod32krn.exe[1476] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 .text G:\Program Files\Eset\nod32krn.exe[1476] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text G:\Program Files\Eset\nod32krn.exe[1476] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text G:\Program Files\Eset\nod32krn.exe[1476] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000801A8 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00080090 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00080694 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000802C0 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00080234 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00080004 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0008011C .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 000804F0 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0008057C .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 000803D8 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0008034C .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00080464 .text C:\WINDOWS\Explorer.EXE[1504] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00080608 .text C:\WINDOWS\Explorer.EXE[1504] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 000807AC .text C:\WINDOWS\Explorer.EXE[1504] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00080720 .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetOpenW 771AAEFD 5 Bytes JMP 00080DB0 .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetConnectA 771B30C3 5 Bytes JMP 00080F54 .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetOpenA 771B58BA 5 Bytes JMP 00080D24 .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetOpenUrlA 771B5B6D 5 Bytes JMP 00080E3C .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetConnectW 771BEE00 5 Bytes JMP 00080FE0 .text C:\WINDOWS\Explorer.EXE[1504] WININET.dll!InternetOpenUrlW 771C5B52 5 Bytes JMP 00080EC8 .text C:\WINDOWS\Explorer.EXE[1504] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000808C4 .text C:\WINDOWS\Explorer.EXE[1504] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00080838 .text C:\WINDOWS\Explorer.EXE[1504] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00080950 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 000301A8 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00030090 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00030694 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 000302C0 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00030234 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00030004 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0003011C .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 000304F0 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0003057C .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 000303D8 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0003034C .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00030464 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00030608 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 000307AC .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00030720 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WS2_32.dll!socket 71A53B91 5 Bytes JMP 000308C4 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00030838 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00030950 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetOpenW 771AAEFD 5 Bytes JMP 00030DB0 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetConnectA 771B30C3 5 Bytes JMP 00030F54 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetOpenA 771B58BA 5 Bytes JMP 00030D24 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetOpenUrlA 771B5B6D 5 Bytes JMP 00030E3C .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetConnectW 771BEE00 5 Bytes JMP 00030FE0 .text G:\Program Files\Sunbelt Software\kpf4ss.exe[1568] WININET.dll!InternetOpenUrlW 771C5B52 5 Bytes JMP 00030EC8 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text G:\Program Files\Eset\nod32kui.exe[2008] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text G:\Program Files\Eset\nod32kui.exe[2008] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text G:\Program Files\Eset\nod32kui.exe[2008] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] WS2_32.dll!socket 71A53B91 5 Bytes JMP 001308C4 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] WS2_32.dll!bind 71A53E00 5 Bytes JMP 00130838 .text G:\Program Files\Sunbelt Software\kpf4gui.exe[2252] WS2_32.dll!connect 71A5406A 5 Bytes JMP 00130950 .text C:\Gmer\gmer.exe[2904] kernel32.dll!VirtualProtectEx 7C801A5D 5 Bytes JMP 001301A8 .text C:\Gmer\gmer.exe[2904] kernel32.dll!VirtualProtect 7C801AD0 5 Bytes JMP 00130090 .text C:\Gmer\gmer.exe[2904] kernel32.dll!WriteProcessMemory 7C80220F 5 Bytes JMP 00130694 .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateProcessW 7C802332 5 Bytes JMP 001302C0 .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateProcessA 7C802367 5 Bytes JMP 00130234 .text C:\Gmer\gmer.exe[2904] kernel32.dll!VirtualAlloc 7C809A51 5 Bytes JMP 00130004 .text C:\Gmer\gmer.exe[2904] kernel32.dll!VirtualAllocEx 7C809A72 5 Bytes JMP 0013011C .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateRemoteThread 7C81042C 5 Bytes JMP 001304F0 .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateThread 7C810637 5 Bytes JMP 0013057C .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateProcessInternalW 7C819513 5 Bytes JMP 001303D8 .text C:\Gmer\gmer.exe[2904] kernel32.dll!CreateProcessInternalA 7C81DDD6 5 Bytes JMP 0013034C .text C:\Gmer\gmer.exe[2904] kernel32.dll!WinExec 7C86136D 5 Bytes JMP 00130464 .text C:\Gmer\gmer.exe[2904] kernel32.dll!SetThreadContext 7C862AA5 5 Bytes JMP 00130608 .text C:\Gmer\gmer.exe[2904] USER32.dll!SetWindowsHookExW 7E37DDB5 5 Bytes JMP 001307AC .text C:\Gmer\gmer.exe[2904] USER32.dll!SetWindowsHookExA 7E3811D1 5 Bytes JMP 00130720 ---- Devices - GMER 1.0.12 ---- Device \FileSystem\Udfs \UdfsCdRom IRP_MJ_FILE_SYSTEM_CONTROL [F428262A] BsUDF.SYS Device \FileSystem\Udfs \UdfsDisk IRP_MJ_FILE_SYSTEM_CONTROL [F428262A] BsUDF.SYS Device \FileSystem\Cdfs \Cdfs IRP_MJ_FILE_SYSTEM_CONTROL [F428262A] BsUDF.SYS ---- EOF - GMER 1.0.12 ----

Jak tego rootkita rozpoznać :o

Gutek · 5 Czerwiec 2007 16:07

Nie ma rootkitów. Optymalizacja XP: http://forum.dobreprogramy.pl/viewtopic.php?t=76580

Broda23 · 5 Czerwiec 2007 16:24

Czy w takim razie usuwać to co wcześniej doradziłeś:

i czy należy to robić w trybie awaryjnym czy w którymś z proramów antyrootkit-owych ?

A swoją drogą poprawiłeś mi ekstra humor. Wielkie DZIĘKI

Gutek · 5 Czerwiec 2007 16:54

Tak miałeś to zrobić

Broda23 · 5 Czerwiec 2007 17:55

Wpisy wyczyściłem w HijakckThis bo tak jest najłatwiej. Wyrzuciłem przy okazji jeszcze jeden

Dziwne bo w pierwszym skanie nie występuje. Wyszedł w poleceniu Gdybym to przewidział wkleiłbym go do sprawdzenia. Idąc za twoją sugestią rozumiem, że wszelkie wpisy bez plików należy usuwać jako zbędny balast. W najgorszym razie czeka mnie Pozdrawiam serdecznie.