Are these dangerous?
Quote:
|
GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-09-13 17:20:36 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000039 WDC_WD5000LPVT-22G33T0 rev.01.01A01 465.76GB Running: z4rlpubl.exe; Driver: C:\Users\iChad\AppData\Local\Temp\pxlorpow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\Explorer.EXE[8052] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 742 000007f834bc1b32 4 bytes [BC, 34, F8, 07] .text C:\Windows\Explorer.EXE[8052] C:\Windows\SYSTEM32\WSOCK32.dll!recvfrom + 750 000007f834bc1b3a 4 bytes [BC, 34, F8, 07] .text C:\Windows\system32\taskhost.exe[7960] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f83b2c1532 4 bytes [2C, 3B, F8, 07] .text C:\Windows\system32\taskhost.exe[7960] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f83b2c153a 4 bytes [2C, 3B, F8, 07] .text C:\Windows\system32\taskhost.exe[7960] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f83b2c165a 4 bytes [2C, 3B, F8, 07] .text C:\Windows\Explorer.EXE[8052] C:\Windows\system32\RPCRT4.dll!NdrStubCall2 000007f83f588840 6 bytes JMP 000007f841990845 .text C:\Windows\system32\lsass.exe[844] C:\Windows\system32\RPCRT4.dll!NdrStubCall2 000007f83f588840 6 bytes JMP 000007f841af06a3 .text C:\Windows\System32\svchost.exe[1096] C:\Windows\system32\RPCRT4.dll!NdrStubCall2 000007f83f588840 6 bytes JMP 000007f841af0845 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\system32\RPCRT4.dll!NdrStubCall2 000007f83f588840 6 bytes JMP 000007f841af0845 .text C:\Windows\system32\svchost.exe[644] C:\Windows\system32\RPCRT4.dll!NdrStubCall2 000007f83f588840 6 bytes JMP 000007f841af0845 .text C:\Windows\Explorer.EXE[8052] C:\Windows\system32\RPCRT4.dll!NdrServerInitialize 000007f83f58c300 6 bytes JMP 000007f841990774 .text C:\Windows\system32\lsass.exe[844] C:\Windows\system32\RPCRT4.dll!NdrServerInitialize 000007f83f58c300 6 bytes JMP 000007f841af05d2 .text C:\Windows\System32\svchost.exe[1096] C:\Windows\system32\RPCRT4.dll!NdrServerInitialize 000007f83f58c300 6 bytes JMP 000007f841af0774 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\system32\RPCRT4.dll!NdrServerInitialize 000007f83f58c300 6 bytes JMP 000007f841af0774 .text C:\Windows\system32\svchost.exe[644] C:\Windows\system32\RPCRT4.dll!NdrServerInitialize 000007f83f58c300 6 bytes JMP 000007f841af0774 .text C:\Windows\Explorer.EXE[8052] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f83fa1bee0 5 bytes JMP 000007f8419906a3 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\system32\USER32.dll!SetWindowsHookExW 000007f83fa1bee0 5 bytes JMP 000007f841af06a3 .text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExW 000007f83fa1bee0 5 bytes JMP 000007f841af06a3 .text C:\Windows\Explorer.EXE[8052] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f83fa41850 12 bytes JMP 000007f8419905d2 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\system32\USER32.dll!SetWindowsHookExA 000007f83fa41850 12 bytes JMP 000007f841af05d2 .text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\user32.dll!SetWindowsHookExA 000007f83fa41850 12 bytes JMP 000007f841af05d2 .text C:\Windows\Explorer.EXE[8052] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941990501 .text C:\Windows\system32\lsass.exe[844] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\System32\svchost.exe[1096] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\system32\svchost.exe[368] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!NtSetSecurityObject 000007f841b04401 8 bytes JMP 000007f941af0501 .text C:\Windows\Explorer.EXE[8052] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941990430 .text C:\Windows\system32\lsass.exe[844] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\system32\services.exe[836] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\System32\svchost.exe[1096] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\system32\svchost.exe[2068] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\system32\svchost.exe[368] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\system32\svchost.exe[644] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 .text C:\Windows\system32\svchost.exe[972] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll 000007f841b1dfe4 5 bytes JMP 000007f941af0430 ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff960002b9e00 7 bytes [C0, CB, 1C, 01, 00, 7B, 9B] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff960002b9e08 7 bytes [01, 10, E4, FF, 00, 5F, E8] ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [4332:1480] fffff960008145e8 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ---- |