Page 1 of 3 123 LastLast
Results 1 to 10 of 23

Thread: Popup problem

  1. 2007-10-10, 18:30 #1
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default Popup problem

    I have checked my computer with avast antivirus,adaware and spybot but i cant get rid of this two popups:
    fp.pc-on-internet.com
    fp.gad-network.com

    please help me

    here is the hjt log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 18:33:49, on 10.10.2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Spybot - Search & Destroy\SDUpdate.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hattrick.org/Common/default.asp
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Free Download Manager\iefdmcks.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O4 - HKLM\..\Run: [SiSUSBRG] C:\WINDOWS\SiSUSBrg.exe
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\SMTray.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [EPSON Stylus C46 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I0T1.EXE /P23 "EPSON Stylus C46 Series" /O6 "USB001" /M "Stylus C46"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
    O4 - HKLM\..\Run: [EPSON Stylus DX5000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE /FU "C:\WINDOWS\TEMP\E_S91.tmp" /EF "HKLM"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
    O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
    O8 - Extra context menu item: Download all with Free Download Manager - file://E:\Free Download Manager\dlall.htm
    O8 - Extra context menu item: Download selected with Free Download Manager - file://E:\Free Download Manager\dlselected.htm
    O8 - Extra context menu item: Download with Free Download Manager - file://E:\Free Download Manager\dllink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O17 - HKLM\System\CCS\Services\Tcpip\..\{5C28DBB8-D3D7-45AC-B3DA-2D338A90B40C}: NameServer = 161.53.114.135 161.53.114.145
    O17 - HKLM\System\CS1\Services\Tcpip\..\{5C28DBB8-D3D7-45AC-B3DA-2D338A90B40C}: NameServer = 161.53.114.135 161.53.114.145
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 6121 bytes
    Last edited by tashi; 2007-10-10 at 18:46. Reason: Merged two posts
  2. 2007-10-12, 10:25 #2
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi Frost Commander

    Do those popups occur when browser is closed, in every web site or in some specific web site(s)?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  3. 2007-10-12, 20:11 #3
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default

    Hi,Shaba

    They occur only when I am conected to the internet and clicking on a site ,if I am downloading something they arent poping up.
  4. 2007-10-13, 10:59 #4
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    In which sites they occur or do they occur on every web site?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  5. 2007-10-13, 18:26 #5
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default

    On every web site.
    When I am fresh conected they pop up a few times in a minute,but how the time goes on, they pop up slower
  6. 2007-10-13, 19:34 #6
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    * Download GMER from
    here:
    Unzip it and start GMER.exe
    Click the rootkit-tab and click scan.

    Once done, click the Copy button.
    This will copy the results to clipboard.
    Paste the results in your next reply.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
  7. 2007-10-14, 15:22 #7
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default Part 1

    Hi

    At the end a window poped up and said:Warning !!!
    GMER has found a system modification caused by ROOTKIT activity.

    Here is it:
    GMER 1.0.13.12551 - http://www.gmer.net
    Rootkit scan 2007-10-14 15:07:53
    Windows 5.1.2600 Service Pack 2


    ---- User code sections - GMER 1.0.13 ----

    .text C:\WINDOWS\system32\csrss.exe[500] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\csrss.exe[500] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\csrss.exe[500] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\csrss.exe[500] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\services.exe[572] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\services.exe[572] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\services.exe[572] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\services.exe[572] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\Ati2evxx.exe[744] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\Ati2evxx.exe[744] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\Ati2evxx.exe[744] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\Ati2evxx.exe[744] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\svchost.exe[760] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\svchost.exe[760] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\svchost.exe[760] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\svchost.exe[760] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\Ati2evxx.exe[800] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\Ati2evxx.exe[800] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\Ati2evxx.exe[800] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\Ati2evxx.exe[800] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\System32\svchost.exe[860] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\System32\svchost.exe[860] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\System32\svchost.exe[860] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\System32\svchost.exe[860] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\Explorer.EXE[1020] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1100] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1100] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1100] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe[1100] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1148] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1148] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1148] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Alwil Software\Avast4\ashServ.exe[1148] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\spoolsv.exe[1332] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\spoolsv.exe[1332] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\spoolsv.exe[1332] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\spoolsv.exe[1332] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1504] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1504] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1504] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\wbem\wmiprvse.exe[1504] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe[1544] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe[1544] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe[1544] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe[1544] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\svchost.exe[1576] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\svchost.exe[1576] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\svchost.exe[1576] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\svchost.exe[1576] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[1760] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[1760] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[1760] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe[1760] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1788] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1788] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1788] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[1788] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Analog Devices\SoundMAX\SMTray.exe[2068] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Analog Devices\SoundMAX\SMTray.exe[2068] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Analog Devices\SoundMAX\SMTray.exe[2068] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Analog Devices\SoundMAX\SMTray.exe[2068] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2084] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2084] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2084] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\HP\HP Software Update\HPWuSchd2.exe[2084] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[2100] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[2100] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[2100] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe[2100] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\windows\system32\kdgubtic.exe[2116] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\windows\system32\kdgubtic.exe[2116] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\windows\system32\kdgubtic.exe[2116] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\windows\system32\kdgubtic.exe[2116] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE[2124] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE[2124] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE[2124] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBVE.EXE[2124] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\WINDOWS\system32\ctfmon.exe[2144] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\WINDOWS\system32\ctfmon.exe[2144] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\WINDOWS\system32\ctfmon.exe[2144] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\WINDOWS\system32\ctfmon.exe[2144] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2152] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 0105200E
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2152] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 01051DAF
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2152] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 01051CF2
    .text C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe[2152] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 0105191B
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2604] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2604] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2604] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Program Files\Internet Explorer\IEXPLORE.EXE[2604] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
    .text C:\Documents and Settings\Martin\Desktop\gmer\gmer.exe[3568] ntdll.dll!NtEnumerateKey 7C90D94C 5 Bytes JMP 1000200E
    .text C:\Documents and Settings\Martin\Desktop\gmer\gmer.exe[3568] ntdll.dll!NtEnumerateValueKey 7C90D976 5 Bytes JMP 10001DAF
    .text C:\Documents and Settings\Martin\Desktop\gmer\gmer.exe[3568] ntdll.dll!NtQueryDirectoryFile 7C90DF5E 5 Bytes JMP 10001CF2
    .text C:\Documents and Settings\Martin\Desktop\gmer\gmer.exe[3568] ntdll.dll!NtQuerySystemInformation 7C90E1AA 5 Bytes JMP 1000191B
  8. 2007-10-14, 15:25 #8
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default Part 2

    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [F7AF3758] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [F7AF81CA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [F7AF3478] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [F7AF3478] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [F7AF8C9C] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [F7AF36FA] sisidex.sys
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_NAMED_PIPE [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLOSE [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_READ [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_WRITE [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_INFORMATION [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_INFORMATION [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_EA [B8ABD812] aswMon2.SYS








    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_EA [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FLUSH_BUFFERS [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_VOLUME_INFORMATION [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_VOLUME_INFORMATION [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DIRECTORY_CONTROL [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_FILE_SYSTEM_CONTROL [B8ABEF76] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CONTROL [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_INTERNAL_DEVICE_CONTROL [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SHUTDOWN [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_LOCK_CONTROL [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CLEANUP [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_CREATE_MAILSLOT [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_SECURITY [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_SECURITY [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_POWER [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SYSTEM_CONTROL [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_DEVICE_CHANGE [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_QUERY_QUOTA [B8ABD812] aswMon2.SYS
    AttachedDevice \FileSystem\Ntfs \Ntfs IRP_MJ_SET_QUOTA [B8ABD812] aswMon2.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_NAMED_PIPE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLOSE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_READ [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_WRITE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_EA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_EA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FLUSH_BUFFERS [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_VOLUME_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_VOLUME_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DIRECTORY_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_FILE_SYSTEM_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_INTERNAL_DEVICE_CONTROL [F79D32C0] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SHUTDOWN [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_LOCK_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CLEANUP [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_CREATE_MAILSLOT [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_SECURITY [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_SECURITY [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_POWER [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SYSTEM_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_DEVICE_CHANGE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_QUERY_QUOTA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Ip IRP_MJ_SET_QUOTA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_NAMED_PIPE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLOSE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_READ [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_WRITE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_EA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_EA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FLUSH_BUFFERS [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_VOLUME_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_VOLUME_INFORMATION [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DIRECTORY_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_FILE_SYSTEM_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_INTERNAL_DEVICE_CONTROL [F79D32C0] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SHUTDOWN [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_LOCK_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CLEANUP [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_CREATE_MAILSLOT [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_SECURITY [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_SECURITY [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_POWER [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SYSTEM_CONTROL [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_DEVICE_CHANGE [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_QUERY_QUOTA [F79D38E6] aswTdi.SYS
    AttachedDevice \Driver\Tcpip \Device\Tcp IRP_MJ_SET_QUOTA [F79D38E6] aswTdi.SYS
  9. 2007-10-14, 15:26 #9
    Frost Commander
    Frost Commander is offline
    Junior Member
    Join Date
    Oct 2007
    Location
    Croatia
    Posts
    16

    Default

    I made a mistake,could somebody delete this last 3 posts and I will fix it
  10. 2007-10-14, 15:27 #10
    Shaba
    Shaba is offline
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    You can re-post if you like to, no need to delete them
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules