virus deactivated Spybot, can not reinstall ...

C

cameraboyNYC

New member
the first thing the virus did was deactivate my antivirus. i ran spybot, and got rid of all but one of the found infections,when i tired to delete the last one i got an access denied message.

when i tried to run spybot again it would not run. i have tried to reinstall it may times but the spybotSD.exe file is never found. i also have had no luck reinstalling any antivirus software.

after posting on 2 other forums and getting no reply after 4 days each (i did not run simultaneous posts!) i ran an analyzer and fixed 4 items. here's the most recent HJT log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:17:19 PM, on 11/6/2007
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16546)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\Explorer.EXE
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\HP\QuickPlay\QPService.exe
C:\Program Files\HP\HP Software Update\hpwuSchd2.exe
C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QLBCTRL.exe
C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
C:\Program Files\Java\jre1.6.0\bin\jusched.exe
C:\Program Files\Common Files\aol\1190014005\ee\aolsoftware.exe
C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
C:\WINDOWS\System32\rundll32.exe
C:\Program Files\AOL 9.0\waol.exe
C:\WINDOWS\System32\notepad.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\Program Files\AOL 9.0\shellmon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_US&c=71&bd=Pavilion&pf=laptop
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\Companion\Installs\cpn0\yt.dll
O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
O4 - HKLM\..\Run: [HP Health Check Scheduler] C:\Program Files\Hewlett-Packard\HP Health Check\HPHC_Scheduler.exe
O4 - HKLM\..\Run: [WAWifiMessage] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\WiFiMsg.exe
O4 - HKLM\..\Run: [hpWirelessAssistant] %ProgramFiles%\Hewlett-Packard\HP Wireless Assistant\HPWAMain.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"
O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1190014005\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AOL Fast Start] "C:\Program Files\AOL 9.0\AOL.EXE" -b (User 'Default user')
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CyberLink Background Capture Service (CBCS) (CLCapSvc) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLCapSvc.exe
O23 - Service: CyberLink Task Scheduler (CTS) (CLSched) - Unknown owner - C:\Program Files\HP\QuickPlay\Kernel\TV\CLSched.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Unknown owner - c:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: HP Health Check Service - Hewlett-Packard - C:\Program Files\Hewlett-Packard\HP Health Check\hphc_service.exe
O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Roxio\Roxio MyDVD Basic v9\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: XAudioService - Conexant Systems, Inc. - C:\Windows\system32\DRIVERS\xaudio.exe

--
End of file - 8326 bytes
 
Hi cameraboyNYC

* Download GMER from
here:
Unzip it and start GMER.exe
Click the rootkit-tab and click scan.

Once done, click the Copy button.
This will copy the results to clipboard.
Paste the results in your next reply.
 
gmer ....

Thank you so much for helping me out! here's the scan results:


GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-11-07 22:43:00
Windows 6.0.6000


---- System - GMER 1.0.13 ----

SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwEnumerateKey
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwEnumerateValueKey
SSDT \??\C:\Windows\system32\windrvNT.sys ZwQueryDirectoryFile
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwQuerySystemInformation

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_READ [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [804D7F42] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [804D7F42] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [804D7D1B] Wdf01000.sys

---- EOF - GMER 1.0.13 ----
 
Hi

Are you sure you waited for entire scan to end?

Report looks quite small.
 
whoops!

sorry, the first time i ran gmer i saw the information pop up in the window so i thought it had run! last nite i reopened the program and clicked scan. it was scanning through files very quickly. after about 10 mins i started watching tv, looking at the computer every 5 mins or so to see if it was done. i fell asleep for abt an hour, when i woke up it was still scanning and i noticed that it was going through files much more slowly, about 1 file every 20 seconds. i thought maybe there was a problem so i stopped the scan, rebooted my computer and scanned again. again, in the beginning it was going through files very quickly so i went to sleep.

i just woke up after 5 hours of sleep and it was still not done, again going through files very very slowly. is that normal? i need to shut down my computer to take it to work.

=/

here is what it had scanned so far:
(it keeps telling me my post is too long, so il'll send it in 2 parts)

GMER 1.0.13.12551 - http://www.gmer.net
Rootkit scan 2007-11-08 08:04:10
Windows 6.0.6000


---- System - GMER 1.0.13 ----

SSDT \??\C:\Windows\system32\windrvNT.sys ZwCreateFile
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwEnumerateKey
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwEnumerateValueKey
SSDT \??\C:\Windows\system32\windrvNT.sys ZwOpenFile
SSDT \??\C:\Windows\system32\windrvNT.sys ZwQueryDirectoryFile
SSDT \??\C:\Windows\system32\windrvNT.sys ZwQueryInformationProcess
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwQueryKey
SSDT \??\C:\Windows\system32\drivers\srosa.sys ZwQuerySystemInformation
SSDT \??\C:\Windows\system32\windrvNT.sys ZwSetInformationFile

---- User IAT/EAT - GMER 1.0.13 ----

IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\WS2_32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!LoadLibraryA] [6BFA9979] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe[208] @ C:\Windows\system32\psapi.dll [KERNEL32.dll!SetUnhandledExceptionFilter] [6BFA9A27] C:\Program Files\Common Files\AOL\AOLDiag\tbdiag.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [6ED31923] C:\Windows\AppPatch\AcLayers.DLL
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\WINDOWS\System32\USERENV.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\WINDOWS\System32\Secur32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CopyFileW] [6DA188F6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!MoveFileW] [6DA18B2F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT
 
part 2...

IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [6ED31923] C:\Windows\AppPatch\AcLayers.DLL
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\WINDOWS\System32\USERENV.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\WINDOWS\System32\rundll32.exe[2840] @ C:\WINDOWS\System32\Secur32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CopyFileW] [6DA188F6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!MoveFileW] [6DA18B2F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USER32.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CopyFileW] [6DA188F6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!OpenFile] [6DA18C84] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!CopyFileW] [6DA188F6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!MoveFileW] [6DA18B2F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegCreateKeyExA] [6DA1952A] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegSetValueExA] [6DA19AFB] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExA] [6DA19741] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\RPCRT4.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateProcessW] [6DA12E2C] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesExW] [6DA12C16] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetFileAttributesW] [6DA12A18] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!AccessCheck] [6DA1883A] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegSetValueW] [6DA19A53] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegDeleteValueW] [6DA19CF9] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\ole32.dll [ADVAPI32.dll!RegOpenKeyExA] [6DA19741] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesW] [6DA18FA6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!SetFileAttributesA] [6DA18F4E] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!CreateFileA] [6DA1A275] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegSetValueExA] [6DA19AFB] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExA] [6DA1952A] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExA] [6DA19741] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteValueA] [6DA19C57] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHLWAPI.dll [ADVAPI32.dll!RegDeleteValueW] [6DA19CF9] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!SetFileSecurityW] [6DA19DF4] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegOpenKeyExA] [6DA19741] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [ADVAPI32.dll!AccessCheck] [6DA1883A] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!MoveFileExW] [6DA18C14] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CopyFileW] [6DA188F6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileW] [6DA18B2F] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!SetFileAttributesW] [6DA18FA6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!MoveFileExW] [6DA18C14] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegDeleteValueW] [6DA19CF9] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegSetValueW] [6DA19A53] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegCreateKeyW] [6DA19498] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!SetFileSecurityW] [6DA19DF4] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!AccessCheck] [6DA1883A] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\SHELL32.dll [ADVAPI32.dll!RegOpenKeyExA] [6DA19741] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!PrivCopyFileExW] [6DA18EEA] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!MoveFileExW] [6DA18C14] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!DeleteFileW] [6DA18A65] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [KERNEL32.dll!SetFileAttributesW] [6DA18FA6] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!SetFileSecurityW] [6DA19DF4] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\USERENV.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!CreateFileW] [6DA1A391] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [6EE44618] C:\Windows\system32\ShimEng.dll
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegCreateKeyExW] [6DA19639] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegSetValueExW] [6DA19BA7] C:\Windows\AppPatch\AcGenral.DLL
IAT C:\Users\Owner\Desktop\gmer\gmer.exe[3836] @ C:\Windows\system32\Secur32.dll [ADVAPI32.dll!RegOpenKeyExW] [6DA19815] C:\Windows\AppPatch\AcGenral.DLL
 
part 3 ....

it had to be sent in 3 parts ......
=/

AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_NAMED_PIPE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLOSE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_READ [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_WRITE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_EA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_EA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FLUSH_BUFFERS [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_VOLUME_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_VOLUME_INFORMATION [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DIRECTORY_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_FILE_SYSTEM_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_INTERNAL_DEVICE_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SHUTDOWN [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_LOCK_CONTROL [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CLEANUP [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_CREATE_MAILSLOT [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_SECURITY [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_SECURITY [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_POWER [804D7F42] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SYSTEM_CONTROL [804D7F42] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_DEVICE_CHANGE [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_QUERY_QUOTA [804D7D1B] Wdf01000.sys
AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 IRP_MJ_SET_QUOTA [804D7D1B] Wdf01000.sys
 
Hi

Run gmer.exe
Click the tab called Processes and click the Safe... button. The computer will reboot and the Gmer screen will open.
Click Files... and browse to the following file:
C:\Windows\system32\drivers\srosa.sys
Now click Delete

Now click the Services tab. Click the entries in red one by one with your right mouse button and click Delete... Answer Yes to all the warning windows.
When you've removed all the Service entries in red, reboot your computer.

Re-run gmer

Post:

- a fresh HijackThis log
- gmer log
 
cant find....

i ran gmer, clicked on the PROCESSES tab but did not see anything called "safe", nor did i see it on any other tab.
 
look what i found...

while i was poking around i found HIDR.exe in my system32 drivers folder, should i just delete it? how do i get it out of my registry?
 
right above FILES is a checked box laberled "libtraries", the button above that is "restart", above that is another checked box "restore SSDT", then the "kill all" button....

=/
 
Hi

There is no point deleting that as long as rootkit bagle driver is active (srosa.sys).

You can delete that with gmer after you have deleted
srosa.sys in similar way.

So try to find that Safe... button next, please :)

Edit: See below

gmer.jpg
 
Last edited:
Hi

Well my version is the same and it has.

Anyway, re-scan with gmer and post back a fresh gmer log and a fresh HijackThis log.
 
You must log in or register to reply here.
Back
Top