Bonjour, mon pc est lent et redémarre tout seul. J'ai posé mon problème dans un autre forum. Ils ont essayé de m'aider mais non rien pu faire. J'aurais peut-être un peu plus de chance avec vous. Je vous remercie pour votre aide.

Bonjour,

Peux-tu mettre le lien de l'aide apportée sur l'autre forum pour que l'on sache ce qui a été proposé et ce qui a échoué ? (Afin qui tu puisses être aidée ici en fonction.)

CLODUAR a écrit :

Bonjour,

Peux-tu mettre le lien de l'aide apportée sur l'autre forum pour que l'on sache ce qui a été proposé et ce qui a échoué ? (Afin qui tu puisses être aidée ici en fonction.)

J'avais commencé à écrire la même réponse quand j'ai vu ta réponse Cloduar donc juste +1

Salut

Oui, surtout que l'on ne sait pas si l'aide était pour une infection, (là je pense que ça aurait été réglé car les helpers sécurité parviennent généralement à nettoyer le PC)

ou si c'est logiciel/matériel...

Attendons plus de précisions...

Bonsoir et merci de me répondre. Voici le lien de l'aide apportée:

http://www.commentcamarche.net/forum/affich-30498086-pc-tres-lent?page=2

Après avoir lu ton lien, en dernier lieu on te conseillait une désinfection que tu as pas pu suivre.

Clique sur le lien en rouge dans ma signature et suis les instructions pas à pas et cool....

Bonjour, Zephyra

Je vais t'assister au cours de cette désinfection. Si tu es d'accord, on va fixer quelques règles pour que la désinfection soit efficace.

• Si tu as ouvert un sujet similaire sur un autre forum, merci de me prévenir afin que je ne fasse pas de recherches inutiles et par souci d'efficacité (on ne prend pas rendez-vous dans 2 garages pour le même problème mécanique),
• Si tu as des cracks ou des keygens, tu les supprimes,
• Si tu as un windows illégal, je ne désinfecte pas.
• Tu poursuis la désinfection jusqu'au bout, même si tu constates une amélioration rapide, et de préférence sur un temps restreint (pas une réponse tous les 3 jours), sinon, cela ne sert à rien.
• La désinfection comprend un diagnostic, un nettoyage, la suppression des outils utilisés et des conseils pour éviter des ré-infections futures, mettre le système à jour, créer des sauvegardes etc...
• Quelques-uns des outils utilisés peuvent faire réagir certains antivirus, car ils sont puissants et destructeurs s'ils sont mal utilisés.
• Pour me permettre d'établir un diagnostic, peux-tu suivre ces consignes et éditer les trois rapports demandés ? (Adwcleaner, malwarebyte's et ZHPDiag).
• Si tu as des questions, n'hésite pas.

Evasion60

/!\ A effectuer dans l'ordre, "ces consignes"

Reviens avec les trois rapports demandés

Bonjour, je suis désolée pour le retard mis pour vous répondre.Malheureusement, mon pc ne voulait plus fonctionner, il redémarrait seul toutes les 2 ou 3 minutes, ne me laissant pas le temps de faire quoi que ce soit. J'ai donc été obligée de l'emmener chez le technicien. Je pense qu'il va un peu mieux sur le plan vitesse, mais en ce qui concerne les navigateurs, ils continuent tous à planter. Ce qui est assez gênant. Maintenant je ne sais pas si vous pouvez m'aider à régler ce problème. Par ailleurs, est-ce qu'il faut que je fasse les scan comme il m'a été dit ? J'attends votre réponse. Merci et encore une fois mille excuses.

Bonsoir Zephyra

... il redémarrait seul toutes les 2 ou 3 minutes, ne me laissant pas le temps de faire quoi que ce soit. J'ai donc été obligée de l'emmener chez le technicien. ...

Oui, je te conseille de suivre les consignes demandées

Bonne réception

Fichier joint : MBAM.txt

Fichier joint : AdwCleaner[S0].txt

Fichier joint : AdwCleaner[S0].txt

Bonsoir, j'ai essayé à plusieurs reprises d'installer ZHPDiag, à chaque fois un message me dit que le fichier est corrompu. Je l'ai télécharger plus de 10 fois et l'ai installé après chaque téléchargement, toujours le même message. J'envoie donc les deux rapports, en attendant que tu me dises comment faire pour ZHPDiag.

Les rapports de Malwarebytes et de AdwCleaner sont joints plus haut.

Bonjour Zephyra

Tu prends bien ce lien pour son téléchargement =>
http://www.nicolascoolman.fr/download/zhpdiag/

A te lire

Bonsoir, oui j'ai télécharger avec le lien des consignes. Je viens d'essayer de le réinstaller avec le lien que tu m'as donné, voici le message que je reçois :

"The setup files are corrupeted. Please obtain a new copy of the program."

Bonsoir Zaphyra

/!\ J'espère que ce ne sont pas des erreurs d'écritures sur ton disque dur !

/!\ Attention avec FRST, bien suivre l'aide proposée // Tout son environnement doit être sur le Bureau (programme et rapports)

Reviens avec les deux rapports demandés

Bonsoir, voici les liens pour les deux rapports.

http://cjoint.com/?0GDwrA3r8kD

Je te rappelle que mon pc continue à redémarrer seul et que les navigateurs plantent souvent, ce qui me retarde pour répondre.

Bonjour Evasion, merci de m'aider, j'espère seulement que l'on pourra régler le problème. J'ai scanné avec Gmer et voici le lien pour le rapport.

Bonsoir Zephyra

Je suis désolé, mais je ne peux pas exploiter ton rapport sous World
Merci de bien lire mon aide proposée (tuto de Gmer)

Bonsoir Evasion, étant donné que je n'ai pas bien compris où se trouvait le bloc notes pour pouvoir t'envoyer le rapport, je vais le coller ci-dessous :

GMER 2.1.19357 - http://www.gmer.net

Rootkit scan 2014-07-30 12:25:20

Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160212ACE rev.3.ACB 149,05GB

Running: gmer.exe; Driver: C:\DOCUME~1\dzcomp\LOCALS~1\Temp\awrorfoc.sys

---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0xA88EABA6]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0xA88EB684]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwClose [0xA892FD80]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0xA88F76F8]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0xA88F7744]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0xA88F78DE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateKey [0xA892F734]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0xA88F7666]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSection [0xA88F7788]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0xA88F76AE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateThread [0xA88EBBBA]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0xA88F7898]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0xA88EC472]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0xA88EAC0C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteKey [0xA8930446]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteValueKey [0xA89306FC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0xA88EFC68]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateKey [0xA89302B1]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateValueKey [0xA893011C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0xA88EA7F8]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0xA8B88ED0]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0xA88EAC72]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0xA88F005E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0xA88ECF5A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0xA88F7722]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0xA88F7766]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0xA88F7902]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenKey [0xA892FA90]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0xA88F768C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0xA88EF560]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0xA88F7816]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0xA88F76D6]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0xA88EF94C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0xA88F78BC]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0xA8B88C6E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryKey [0xA892FF97]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0xA88ECDCE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryValueKey [0xA892FDE9]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThread [0xA88EC924]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwRenameKey [0xA8B96E1A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwRestoreKey [0xA892ED77]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0xA88EACD8]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0xA88EAD3E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetContextThread [0xA88EC2EC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0xA88EA892]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0xA88EAA64]

Suite 1

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetValueKey [0xA893054D]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0xA88EA9F2]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0xA88EC63C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0xA88EC79E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0xA88EAAEC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateProcess [0xA88EC12A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0xA88EC2CC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0xA88EADA4]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwWriteVirtualMemory [0xA88EB6E0]

---- Kernel code sections - GMER 2.1 ----

.text ntoskrnl.exe!ZwYieldExecution + 33A 804E4B64 4 Bytes JMP CAF6DE66

.text ntoskrnl.exe!ZwYieldExecution + 3C2 804E4BEC 12 Bytes [D8, AC, 8E, A8, 3E, AD, 8E, ...] {FSUBR DWORD [ESI+ECX*4-0x7152c158]; TEST AL, 0xec; RET 0xa88e}

.text ntoskrnl.exe!ZwYieldExecution + 46A 804E4C94 12 Bytes [3C, C6, 8E, A8, 9E, C7, 8E, ...]

PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 80575B10 4 Bytes CALL A88ED62B \SystemRoot\system32\drivers\aswSnx.sys

---- User code sections - GMER 2.1 ----

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\ctfmon.exe[188] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\ctfmon.exe[188] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\System32\smss.exe[620] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\csrss.exe[668] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\csrss.exe[668] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\winlogon.exe[692] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\winlogon.exe[692] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\services.exe[736] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\services.exe[736] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\savedump.exe[748] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\savedump.exe[748] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\lsass.exe[760] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\lsass.exe[760] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[948] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[948] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtCreateFile + 6 7C91D096 4 Bytes [28, 00, 30, 00] {SUB [EAX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtCreateFile + B 7C91D09B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + 6 7C91D506 1 Byte [28]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + 6 7C91D506 4 Bytes [28, 03, 30, 00] {SUB [EBX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + B 7C91D50B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenFile + 6 7C91D586 4 Bytes [68, 00, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenFile + B 7C91D58B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcess + 6 7C91D5E6 4 Bytes [A8, 01, 30, 00] {TEST AL, 0x1; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcess + B 7C91D5EB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessToken + 6 7C91D5F6 4 Bytes CALL 7B9205FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessToken + B 7C91D5FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D606 4 Bytes [A8, 02, 30, 00] {TEST AL, 0x2; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessTokenEx + B 7C91D60B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThread + 6 7C91D646 4 Bytes [68, 01, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThread + B 7C91D64B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadToken + 6 7C91D656 4 Bytes [68, 02, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadToken + B 7C91D65B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D666 4 Bytes CALL 7B92066D

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadTokenEx + B 7C91D66B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryAttributesFile + 6 7C91D6F6 4 Bytes [A8, 00, 30, 00] {TEST AL, 0x0; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryAttributesFile + B 7C91D6FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D796 4 Bytes CALL 7B92079B

Suite 2

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryFullAttributesFile + B 7C91D79B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationFile + 6 7C91DC46 4 Bytes [28, 01, 30, 00] {SUB [ECX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationFile + B 7C91DC4B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationThread + 6 7C91DC96 4 Bytes [28, 02, 30, 00] {SUB [EDX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationThread + B 7C91DC9B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 1 Byte [68]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 4 Bytes [68, 03, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + B 7C91DEFB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!LdrLoadDll 7C9263A3 5 Bytes JMP 003F01F8

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!LdrUnloadDll 7C92736B 5 Bytes JMP 003F03FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\System32\svchost.exe[1132] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\System32\svchost.exe[1132] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtCreateFile + 6 7C91D096 4 Bytes [28, 00, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtCreateFile + B 7C91D09B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + 6 7C91D506 1 Byte [28]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + 6 7C91D506 4 Bytes [28, 03, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + B 7C91D50B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenFile + 6 7C91D586 4 Bytes [68, 00, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenFile + B 7C91D58B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcess + 6 7C91D5E6 4 Bytes [A8, 01, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcess + B 7C91D5EB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessToken + 6 7C91D5F6 4 Bytes CALL 7B9229FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessToken + B 7C91D5FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D606 4 Bytes [A8, 02, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessTokenEx + B 7C91D60B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThread + 6 7C91D646 4 Bytes [68, 01, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThread + B 7C91D64B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadToken + 6 7C91D656 4 Bytes [68, 02, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadToken + B 7C91D65B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D666 4 Bytes CALL 7B922A6D

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadTokenEx + B 7C91D66B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtQueryAttributesFile + 6 7C91D6F6 4 Bytes [A8, 00, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtQueryAttributesFile + B 7C91D6FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D796 4 Bytes CALL 7B922B9B

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtQueryFullAttributesFile + B 7C91D79B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtSetInformationFile + 6 7C91DC46 4 Bytes [28, 01, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtSetInformationFile + B 7C91DC4B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtSetInformationThread + 6 7C91DC96 4 Bytes [28, 02, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtSetInformationThread + B 7C91DC9B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 1 Byte [68]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 4 Bytes [68, 03, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtUnmapViewOfSection + B 7C91DEFB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!LdrLoadDll 7C9263A3 5 Bytes JMP 008D01F8

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!LdrUnloadDll 7C92736B 5 Bytes JMP 008D03FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1256] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1256] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1296] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1296] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1340] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1340] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }

.text C:\Program Files\AVAST Software\Avast\AvastSvc.exe[1340] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\KaraokeSer.exe[1428] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\KaraokeSer.exe[1428] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\spoolsv.exe[1540] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\spoolsv.exe[1540] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\Glary Utilities 5\Integrator.exe[1616] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\Glary Utilities 5\Integrator.exe[1616] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\wdfmgr.exe[1724] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\wdfmgr.exe[1724] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\Explorer.EXE[1816] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\Explorer.EXE[1816] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\igfxtray.exe[1932] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\igfxtray.exe[1932] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

Suite 3

.text C:\WINDOWS\system32\hkcmd.exe[1940] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\hkcmd.exe[1940] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\igfxpers.exe[1948] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\igfxpers.exe[1948] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe[1960] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe[1960] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\Athan\Athan.exe[2004] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\Athan\Athan.exe[2004] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\Real\RealPlayer\update\realsched.exe[2036] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\Real\RealPlayer\update\realsched.exe[2036] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 5 Bytes [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

.text C:\Program Files\Real\RealPlayer\update\realsched.exe[2036] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe[2092] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\ADSL Autoconnect\ADSL Autoconnect.exe[2092] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Bureau\gmer (1)\gmer.exe[2112] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Bureau\gmer (1)\gmer.exe[2112] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtCreateFile + 6 7C91D096 4 Bytes [28, 00, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtCreateFile + B 7C91D09B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtMapViewOfSection + 6 7C91D506 1 Byte [28]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtMapViewOfSection + 6 7C91D506 4 Bytes [28, 03, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtMapViewOfSection + B 7C91D50B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenFile + 6 7C91D586 4 Bytes [68, 00, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenFile + B 7C91D58B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcess + 6 7C91D5E6 4 Bytes [A8, 01, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcess + B 7C91D5EB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcessToken + 6 7C91D5F6 4 Bytes CALL 7B91EBFC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcessToken + B 7C91D5FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D606 4 Bytes [A8, 02, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenProcessTokenEx + B 7C91D60B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThread + 6 7C91D646 4 Bytes [68, 01, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThread + B 7C91D64B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThreadToken + 6 7C91D656 4 Bytes [68, 02, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThreadToken + B 7C91D65B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D666 4 Bytes CALL 7B91EC6D

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtOpenThreadTokenEx + B 7C91D66B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtQueryAttributesFile + 6 7C91D6F6 4 Bytes [A8, 00, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtQueryAttributesFile + B 7C91D6FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D796 4 Bytes CALL 7B91ED9B

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtQueryFullAttributesFile + B 7C91D79B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtSetInformationFile + 6 7C91DC46 4 Bytes [28, 01, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtSetInformationFile + B 7C91DC4B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtSetInformationThread + 6 7C91DC96 4 Bytes [28, 02, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtSetInformationThread + B 7C91DC9B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 1 Byte [68]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 4 Bytes [68, 03, 16, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!NtUnmapViewOfSection + B 7C91DEFB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!LdrLoadDll 7C9263A3 5 Bytes JMP 003F01F8

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] ntdll.dll!LdrUnloadDll 7C92736B 5 Bytes JMP 003F03FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[2200] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\System32\alg.exe[2852] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\System32\alg.exe[2852] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3256] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\wbem\unsecapp.exe[3256] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3596] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\wbem\wmiprvse.exe[3596] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\wscntfy.exe[3844] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\wscntfy.exe[3844] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3888] ntdll.dll!LdrLoadDll 7C9263A3 5 Bytes JMP 003701F8

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3888] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3888] ntdll.dll!LdrUnloadDll 7C92736B 5 Bytes JMP 003703FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[3888] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

---- User IAT/EAT - GMER 2.1 ----

IAT C:\WINDOWS\system32\services.exe[736] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW] 00390002

IAT C:\WINDOWS\system32\services.exe[736] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW] 00390000

---- Devices - GMER 2.1 ----

AttachedDevice \Driver\Tcpip \Device\Ip aswTdi.sys

AttachedDevice \Driver\Tcpip \Device\Tcp aswTdi.sys

AttachedDevice \Driver\Tcpip \Device\Udp aswTdi.sys

Suite 4

AttachedDevice \Driver\Tcpip \Device\RawIp aswTdi.sys

---- Registry - GMER 2.1 ----

Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 724

Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{3F4459F7-0B88-4C2C-972E-45DC0AF1FA52}@DhcpRetryTime 296

---- EOF - GMER 2.1 ----GMER 2.1.19357 - http://www.gmer.net

Rootkit scan 2014-07-30 12:25:20

Windows 5.1.2600 Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3160212ACE rev.3.ACB 149,05GB

Running: gmer.exe; Driver: C:\DOCUME~1\dzcomp\LOCALS~1\Temp\awrorfoc.sys

---- System - GMER 2.1 ----

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAddBootEntry [0xA88EABA6]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwAssignProcessToJobObject [0xA88EB684]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwClose [0xA892FD80]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEvent [0xA88F76F8]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateEventPair [0xA88F7744]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateIoCompletion [0xA88F78DE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateKey [0xA892F734]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateMutant [0xA88F7666]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSection [0xA88F7788]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateSemaphore [0xA88F76AE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateThread [0xA88EBBBA]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwCreateTimer [0xA88F7898]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDebugActiveProcess [0xA88EC472]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteBootEntry [0xA88EAC0C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteKey [0xA8930446]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDeleteValueKey [0xA89306FC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwDuplicateObject [0xA88EFC68]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateKey [0xA89302B1]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwEnumerateValueKey [0xA893011C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwLoadDriver [0xA88EA7F8]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwMapViewOfSection [0xA8B88ED0]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwModifyBootEntry [0xA88EAC72]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeKey [0xA88F005E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwNotifyChangeMultipleKeys [0xA88ECF5A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEvent [0xA88F7722]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenEventPair [0xA88F7766]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenIoCompletion [0xA88F7902]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenKey [0xA892FA90]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenMutant [0xA88F768C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenProcess [0xA88EF560]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSection [0xA88F7816]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenSemaphore [0xA88F76D6]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenThread [0xA88EF94C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwOpenTimer [0xA88F78BC]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwProtectVirtualMemory [0xA8B88C6E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryKey [0xA892FF97]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryObject [0xA88ECDCE]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueryValueKey [0xA892FDE9]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwQueueApcThread [0xA88EC924]

SSDT \SystemRoot\system32\drivers\aswSP.sys ZwRenameKey [0xA8B96E1A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwRestoreKey [0xA892ED77]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootEntryOrder [0xA88EACD8]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetBootOptions [0xA88EAD3E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetContextThread [0xA88EC2EC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemInformation [0xA88EA892]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetSystemPowerState [0xA88EAA64]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSetValueKey [0xA893054D]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwShutdownSystem [0xA88EA9F2]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendProcess [0xA88EC63C]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSuspendThread [0xA88EC79E]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwSystemDebugControl [0xA88EAAEC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateProcess [0xA88EC12A]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwTerminateThread [0xA88EC2CC]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwVdmControl [0xA88EADA4]

SSDT \SystemRoot\system32\drivers\aswSnx.sys ZwWriteVirtualMemory [0xA88EB6E0]

---- Kernel code sections - GMER 2.1 ----

.text ntoskrnl.exe!ZwYieldExecution + 33A 804E4B64 4 Bytes JMP CAF6DE66

.text ntoskrnl.exe!ZwYieldExecution + 3C2 804E4BEC 12 Bytes [D8, AC, 8E, A8, 3E, AD, 8E, ...] {FSUBR DWORD [ESI+ECX*4-0x7152c158]; TEST AL, 0xec; RET 0xa88e}

.text ntoskrnl.exe!ZwYieldExecution + 46A 804E4C94 12 Bytes [3C, C6, 8E, A8, 9E, C7, 8E, ...]

PAGE ntoskrnl.exe!ZwReplyWaitReceivePortEx + 3CC 80575B10 4 Bytes CALL A88ED62B \SystemRoot\system32\drivers\aswSnx.sys

---- User code sections - GMER 2.1 ----

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] kernel32.dll!SetUnhandledExceptionFilter 7C8449FD 8 Bytes [31, C0, C2, 04, 00, 90, 90, ...] {XOR EAX, EAX; RET 0x4; NOP ; NOP ; NOP }

.text C:\Program Files\AVAST Software\Avast\AvastUI.exe[160] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\ctfmon.exe[188] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\ctfmon.exe[188] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\System32\smss.exe[620] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\csrss.exe[668] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\csrss.exe[668] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\winlogon.exe[692] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\winlogon.exe[692] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

Suite 5

.text C:\WINDOWS\system32\services.exe[736] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\services.exe[736] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\savedump.exe[748] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\savedump.exe[748] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\lsass.exe[760] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\lsass.exe[760] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[948] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[948] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1036] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\system32\svchost.exe[1036] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtCreateFile + 6 7C91D096 4 Bytes [28, 00, 30, 00] {SUB [EAX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtCreateFile + B 7C91D09B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + 6 7C91D506 1 Byte [28]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + 6 7C91D506 4 Bytes [28, 03, 30, 00] {SUB [EBX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtMapViewOfSection + B 7C91D50B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenFile + 6 7C91D586 4 Bytes [68, 00, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenFile + B 7C91D58B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcess + 6 7C91D5E6 4 Bytes [A8, 01, 30, 00] {TEST AL, 0x1; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcess + B 7C91D5EB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessToken + 6 7C91D5F6 4 Bytes CALL 7B9205FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessToken + B 7C91D5FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D606 4 Bytes [A8, 02, 30, 00] {TEST AL, 0x2; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenProcessTokenEx + B 7C91D60B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThread + 6 7C91D646 4 Bytes [68, 01, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThread + B 7C91D64B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadToken + 6 7C91D656 4 Bytes [68, 02, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadToken + B 7C91D65B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D666 4 Bytes CALL 7B92066D

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtOpenThreadTokenEx + B 7C91D66B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryAttributesFile + 6 7C91D6F6 4 Bytes [A8, 00, 30, 00] {TEST AL, 0x0; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryAttributesFile + B 7C91D6FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryFullAttributesFile + 6 7C91D796 4 Bytes CALL 7B92079B

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtQueryFullAttributesFile + B 7C91D79B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationFile + 6 7C91DC46 4 Bytes [28, 01, 30, 00] {SUB [ECX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationFile + B 7C91DC4B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationThread + 6 7C91DC96 4 Bytes [28, 02, 30, 00] {SUB [EDX], AL; XOR [EAX], AL}

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtSetInformationThread + B 7C91DC9B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 1 Byte [68]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + 6 7C91DEF6 4 Bytes [68, 03, 30, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!NtUnmapViewOfSection + B 7C91DEFB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!LdrLoadDll 7C9263A3 5 Bytes JMP 003F01F8

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] ntdll.dll!LdrUnloadDll 7C92736B 5 Bytes JMP 003F03FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1072] KERNEL32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\WINDOWS\System32\svchost.exe[1132] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9271AA 1 Byte [62]

.text C:\WINDOWS\System32\svchost.exe[1132] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtCreateFile + 6 7C91D096 4 Bytes [28, 00, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtCreateFile + B 7C91D09B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + 6 7C91D506 1 Byte [28]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + 6 7C91D506 4 Bytes [28, 03, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtMapViewOfSection + B 7C91D50B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenFile + 6 7C91D586 4 Bytes [68, 00, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenFile + B 7C91D58B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcess + 6 7C91D5E6 4 Bytes [A8, 01, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcess + B 7C91D5EB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessToken + 6 7C91D5F6 4 Bytes CALL 7B9229FC

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessToken + B 7C91D5FB 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessTokenEx + 6 7C91D606 4 Bytes [A8, 02, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenProcessTokenEx + B 7C91D60B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThread + 6 7C91D646 4 Bytes [68, 01, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThread + B 7C91D64B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadToken + 6 7C91D656 4 Bytes [68, 02, 54, 00]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadToken + B 7C91D65B 1 Byte [E2]

.text C:\Documents and Settings\dzcomp\Local Settings\Application Data\Google\Chrome\Application\chrome.exe[1212] ntdll.dll!NtOpenThreadTokenEx + 6 7C91D666 4 Bytes CALL 7B922A6D