| schorsch85 | 27.08.2014 07:29 |
Gmer: Code:
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-08-25 21:18:31
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD64 rev.01.0 596,17GB
Running: Gmer-19357.exe; Driver: C:\Users\Georg\AppData\Local\Temp\kwloqpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80003ba5000 52 bytes [00, 00, 25, 02, 6B, 6C, 78, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 751 fffff80003ba50df 7 bytes [46, 00, 42, 00, 38, 00, 31]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000749e1465 2 bytes [9E, 74]
.text C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000749e14bb 2 bytes [9E, 74]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000076d911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000076d91390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d9143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000076d9158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d9191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000076d91b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000076d91bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d91d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000076d91eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d91edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000076d91f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000076d91fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000076d91fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000076d92272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000076d92301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000076d92792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d9282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000076d92890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d92d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000076d92d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000076d93023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d9323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000076d933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d93a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d93ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d93b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000076d93d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d94190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076de1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076de1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076de1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076de1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076de1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076de1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076de1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076de27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007494146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074941a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074941a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074941a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 14.0.0\klwtblfs.exe[3332] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074941a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000076d911f5 8 bytes {JMP 0xd}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000076d91390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d9143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000076d9158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d9191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000076d91b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000076d91bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d91d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000076d91eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d91edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000076d91f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000076d91fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000076d91fd7 8 bytes {JMP 0xb}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000076d92272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000076d92301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000076d92792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d927d2 8 bytes {JMP 0x10}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d9282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000076d92890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d92d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000076d92d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000076d93023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d9323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000076d933c0 16 bytes {JMP 0x4e}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d93a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d93ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d93b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000076d93d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d94190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076de1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076de1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076de1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076de1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076de1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076de1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076de1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076de27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007494146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074941a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074941a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074941a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[1052] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074941a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 5 0000000076d911f5 8 bytes {JMP 0xd}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlWalkHeap + 416 0000000076d91390 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 159 0000000076d9143f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlpEnsureBufferSize + 492 0000000076d9158c 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 126 0000000076d9191e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlDeleteAce + 636 0000000076d91b1c 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!_vsnwprintf_s + 204 0000000076d91bf0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 373 0000000076d91d75 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlCreateActivationContext + 691 0000000076d91eb3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!isalpha + 31 0000000076d91edf 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!_ui64toa + 84 0000000076d91f64 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!_strnicmp + 81 0000000076d91fbd 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelf + 7 0000000076d91fd7 8 bytes {JMP 0xb}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 658 0000000076d92272 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlImpersonateSelfEx + 801 0000000076d92301 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlInstallFunctionTableCallback + 578 0000000076d92792 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlIsGenericTableEmptyAvl + 16 0000000076d927b0 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableAvl + 18 0000000076d927d2 8 bytes {JMP 0x10}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 79 0000000076d9282f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlEnumerateGenericTableWithoutSplayingAvl + 176 0000000076d92890 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 2
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 299 0000000076d92d1b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlValidRelativeSecurityDescriptor + 367 0000000076d92d5f 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text ... * 3
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlCutoverTimeToSystemTime + 483 0000000076d93023 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 523 0000000076d9323b 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlQueryRegistryValues + 912 0000000076d933c0 16 bytes {JMP 0x4e}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 318 0000000076d93a5e 16 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!_itow_s + 403 0000000076d93ab3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 197 0000000076d93b85 8 bytes [10, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlpCheckDynamicTimeZoneInformation + 611 0000000076d93d23 8 bytes [00, 6A, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!RtlpGetLCIDFromLangInfoNode + 80 0000000076d94190 8 bytes [A0, 69, F8, 7E, 00, 00, 00, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread 0000000076de1380 8 bytes {JMP QWORD [RIP-0x4d4cf]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtQueryInformationThread 0000000076de1500 8 bytes {JMP QWORD [RIP-0x4d498]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000076de1530 8 bytes {JMP QWORD [RIP-0x4d9b1]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000076de1650 8 bytes {JMP QWORD [RIP-0x4d7a7]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtQueueApcThread 0000000076de1700 8 bytes {JMP QWORD [RIP-0x4d9e3]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtCreateThreadEx 0000000076de1d30 8 bytes {JMP QWORD [RIP-0x4dba6]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtGetContextThread 0000000076de1f80 8 bytes {JMP QWORD [RIP-0x4de55]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\ntdll.dll!NtSetContextThread 0000000076de27e0 8 bytes {JMP QWORD [RIP-0x4e770]}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 312 00000000749413cc 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuInitializeStartupContext + 471 000000007494146b 8 bytes {JMP 0xffffffffffffffb0}
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessInit + 611 00000000749416d7 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessTerm + 3 00000000749416e3 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuGetStackPointer + 23 00000000749419db 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetStackPointer + 23 00000000749419fb 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuSetInstructionPointer + 23 0000000074941a1b 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuNotifyAffinityChange + 3 0000000074941a27 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuFlushInstructionCache + 23 0000000074941a63 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
.text C:\Users\Georg\Desktop\Gmer-19357.exe[4920] C:\Windows\SYSTEM32\wow64cpu.dll!CpuProcessDebugEvent + 3 0000000074941a6f 8 bytes [0D, F0, AD, BA, DE, C0, AD, ...]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\svchost.exe [2680:3488] 000007fef32f9688
---- Processes - GMER 2.1 ----
Library c:\users\georg\appdata\local\temp\7zs7084\hpslpsvc64.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [4644] (HP Network Devices Support/Hewlett-Packard Co.)(2012-09-27 00:52:50) 0000000180000000
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x2F 0x3D 0xD3 0xAA ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA7 0xB9 0xE4 0xF7 ...
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0
Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0x88 0x51 0x65 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files (x86)\DAEMON Tools Lite\
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x2F 0x3D 0xD3 0xAA ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xA7 0xB9 0xE4 0xF7 ...
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet)
Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xD6 0x88 0x51 0x65 ...
---- EOF - GMER 2.1 ----
defogger: Code:
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 18:58 on 25/08/2014 (Georg)
Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.
HKCU:DAEMON Tools Lite -> Removed
Checking for services/drivers...
SPTD -> Disabled (Service running -> reboot required)
-=E.O.F=-
|
Lesestoff:
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
Malwarebytes Anti-Malware 
