ROOTREPEAL (c) AD, 2007-2008
==================================================
Scan Time: 2009/05/14 14:32
Program Version: Version 1.2.3.0
Windows Version: Windows XP Media Center Edition SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF439A000 Size: 98304 File Visible: No
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B52000 Size: 8192 File Visible: No
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF141B000 Size: 45056 File Visible: No
Status: -
Name: UACbqhohxllldbbaom.sys
Image Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Address: 0xF469A000 Size: 77824 File Visible: -
Status: Hidden from Windows API!
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!
Path: C:\WINDOWS\system32\UACbqhqbcrgeoxujrk.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACdqbwuljiufvoqvf.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACepoonjxehuqvngw.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACfsrnxyejglmajyt.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACpgrcykcjkxtkipj.log
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACrtlwawirgdowgix.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACycmuwqvnylksdpq.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Eric\Local Settings\Temp\UACb50a.tmp
Status: Invisible to the Windows API!
SSDT
-------------------
SYSENTER/INT2E Hooked [0x0046a530]!
Stealth Objects
-------------------
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: winlogon.exe (PID: 664) Address: 0x006a0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: winlogon.exe (PID: 664) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: services.exe (PID: 720) Address: 0x00660000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: services.exe (PID: 720) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: lsass.exe (PID: 732) Address: 0x006f0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: lsass.exe (PID: 732) Address: 0x007e0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Ati2evxx.exe (PID: 936) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Ati2evxx.exe (PID: 936) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 956) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 956) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1060) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1060) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1168) Address: 0x00800000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1168) Address: 0x00a10000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1296) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1296) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1432) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1432) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: spoolsv.exe (PID: 1672) Address: 0x00b00000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: spoolsv.exe (PID: 1672) Address: 0x00a30000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 128) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 128) Address: 0x00b70000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ctfmon.exe (PID: 296) Address: 0x00940000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ctfmon.exe (PID: 296) Address: 0x00a50000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehtray.exe (PID: 116) Address: 0x00a10000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehtray.exe (PID: 116) Address: 0x00b30000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: jusched.exe (PID: 324) Address: 0x00cf0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: jusched.exe (PID: 324) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: stsystra.exe (PID: 136) Address: 0x00be0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: stsystra.exe (PID: 136) Address: 0x00cb0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1140) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1140) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: DLACTRLW.EXE (PID: 1288) Address: 0x00b20000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: DLACTRLW.EXE (PID: 1288) Address: 0x00a50000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktop.exe (PID: 1272) Address: 0x00a80000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktop.exe (PID: 1272) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: hpcmpmgr.exe (PID: 1408) Address: 0x00ae0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: hpcmpmgr.exe (PID: 1408) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: HPWuSchd2.exe (PID: 1416) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: HPWuSchd2.exe (PID: 1416) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: AppleMobileDeviceService.exe (PID: 1500) Address: 0x00740000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: AppleMobileDeviceService.exe (PID: 1500) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: OneTouch.exe (PID: 1540) Address: 0x00b50000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: OneTouch.exe (PID: 1540) Address: 0x00c10000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktopIndex.exe (PID: 1620) Address: 0x00a20000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktopIndex.exe (PID: 1620) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: MMDiag.exe (PID: 1640) Address: 0x00c50000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: MMDiag.exe (PID: 1640) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgwdsvc.exe (PID: 868) Address: 0x00740000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgwdsvc.exe (PID: 868) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: MXOALDR.EXE (PID: 1760) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: MXOALDR.EXE (PID: 1760) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktopDisplay.exe (PID: 1808) Address: 0x003e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktopDisplay.exe (PID: 1808) Address: 0x00b00000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehRecvr.exe (PID: 1848) Address: 0x00650000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehRecvr.exe (PID: 1848) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: apdproxy.exe (PID: 1868) Address: 0x00af0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: apdproxy.exe (PID: 1868) Address: 0x00bc0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehSched.exe (PID: 1920) Address: 0x00630000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehSched.exe (PID: 1920) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: realsched.exe (PID: 1928) Address: 0x00a90000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: realsched.exe (PID: 1928) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: mim.exe (PID: 1916) Address: 0x00ae0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: mim.exe (PID: 1916) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: jqs.exe (PID: 400) Address: 0x00760000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: jqs.exe (PID: 400) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: iTunesHelper.exe (PID: 396) Address: 0x00be0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: iTunesHelper.exe (PID: 396) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgrsx.exe (PID: 572) Address: 0x00770000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgrsx.exe (PID: 572) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgnsx.exe (PID: 1008) Address: 0x007d0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgnsx.exe (PID: 1008) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: isuspm.exe (PID: 2544) Address: 0x00ac0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: isuspm.exe (PID: 2544) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 2896) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 2896) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 3000) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 3000) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: mcrdsvc.exe (PID: 3212) Address: 0x00680000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: mcrdsvc.exe (PID: 3212) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: explorer.exe (PID: 3460) Address: 0x00c60000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: explorer.exe (PID: 3460) Address: 0x00d90000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: dllhost.exe (PID: 3744) Address: 0x006d0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: dllhost.exe (PID: 3744) Address: 0x007a0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: alg.exe (PID: 4000) Address: 0x00820000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: alg.exe (PID: 4000) Address: 0x00750000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: iPodService.exe (PID: 2452) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: iPodService.exe (PID: 2452) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 896) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 896) Address: 0x00b70000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: AcroRd32.exe (PID: 2220) Address: 0x00a80000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: AcroRd32.exe (PID: 2220) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: RootRepeal.exe (PID: 3856) Address: 0x00ef0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: RootRepeal.exe (PID: 3856) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 3540) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 3540) Address: 0x00b70000 Size: 45056
Hidden Services
-------------------
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Also...A RootRepeal Error window popped up when scan was done that said: Could not get our real service table pointers!
Details--Warning - the number of SSDT entries from the kernel and the number on-disk are different (284 and 0)
==================================================
Scan Time: 2009/05/14 14:32
Program Version: Version 1.2.3.0
Windows Version: Windows XP Media Center Edition SP3
==================================================
Drivers
-------------------
Name: dump_atapi.sys
Image Path: C:\WINDOWS\System32\Drivers\dump_atapi.sys
Address: 0xF439A000 Size: 98304 File Visible: No
Status: -
Name: dump_WMILIB.SYS
Image Path: C:\WINDOWS\System32\Drivers\dump_WMILIB.SYS
Address: 0xF7B52000 Size: 8192 File Visible: No
Status: -
Name: rootrepeal.sys
Image Path: C:\WINDOWS\system32\drivers\rootrepeal.sys
Address: 0xF141B000 Size: 45056 File Visible: No
Status: -
Name: UACbqhohxllldbbaom.sys
Image Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Address: 0xF469A000 Size: 77824 File Visible: -
Status: Hidden from Windows API!
Hidden/Locked Files
-------------------
Path: C:\hiberfil.sys
Status: Locked to the Windows API!
Path: C:\WINDOWS\system32\UACbqhqbcrgeoxujrk.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACdqbwuljiufvoqvf.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACepoonjxehuqvngw.dat
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACfsrnxyejglmajyt.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\uacinit.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACpgrcykcjkxtkipj.log
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACrtlwawirgdowgix.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\UACycmuwqvnylksdpq.dll
Status: Invisible to the Windows API!
Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Status: Invisible to the Windows API!
Path: C:\Documents and Settings\Eric\Local Settings\Temp\UACb50a.tmp
Status: Invisible to the Windows API!
SSDT
-------------------
SYSENTER/INT2E Hooked [0x0046a530]!
Stealth Objects
-------------------
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: winlogon.exe (PID: 664) Address: 0x006a0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: winlogon.exe (PID: 664) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: services.exe (PID: 720) Address: 0x00660000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: services.exe (PID: 720) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: lsass.exe (PID: 732) Address: 0x006f0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: lsass.exe (PID: 732) Address: 0x007e0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Ati2evxx.exe (PID: 936) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Ati2evxx.exe (PID: 936) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 956) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 956) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1060) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1060) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1168) Address: 0x00800000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1168) Address: 0x00a10000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1296) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1296) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1432) Address: 0x007c0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1432) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: spoolsv.exe (PID: 1672) Address: 0x00b00000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: spoolsv.exe (PID: 1672) Address: 0x00a30000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 128) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 128) Address: 0x00b70000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ctfmon.exe (PID: 296) Address: 0x00940000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ctfmon.exe (PID: 296) Address: 0x00a50000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehtray.exe (PID: 116) Address: 0x00a10000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehtray.exe (PID: 116) Address: 0x00b30000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: jusched.exe (PID: 324) Address: 0x00cf0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: jusched.exe (PID: 324) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: stsystra.exe (PID: 136) Address: 0x00be0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: stsystra.exe (PID: 136) Address: 0x00cb0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 1140) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 1140) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: DLACTRLW.EXE (PID: 1288) Address: 0x00b20000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: DLACTRLW.EXE (PID: 1288) Address: 0x00a50000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktop.exe (PID: 1272) Address: 0x00a80000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktop.exe (PID: 1272) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: hpcmpmgr.exe (PID: 1408) Address: 0x00ae0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: hpcmpmgr.exe (PID: 1408) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: HPWuSchd2.exe (PID: 1416) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: HPWuSchd2.exe (PID: 1416) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: AppleMobileDeviceService.exe (PID: 1500) Address: 0x00740000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: AppleMobileDeviceService.exe (PID: 1500) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: OneTouch.exe (PID: 1540) Address: 0x00b50000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: OneTouch.exe (PID: 1540) Address: 0x00c10000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktopIndex.exe (PID: 1620) Address: 0x00a20000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktopIndex.exe (PID: 1620) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: MMDiag.exe (PID: 1640) Address: 0x00c50000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: MMDiag.exe (PID: 1640) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgwdsvc.exe (PID: 868) Address: 0x00740000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgwdsvc.exe (PID: 868) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: MXOALDR.EXE (PID: 1760) Address: 0x00aa0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: MXOALDR.EXE (PID: 1760) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: GoogleDesktopDisplay.exe (PID: 1808) Address: 0x003e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: GoogleDesktopDisplay.exe (PID: 1808) Address: 0x00b00000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehRecvr.exe (PID: 1848) Address: 0x00650000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehRecvr.exe (PID: 1848) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: apdproxy.exe (PID: 1868) Address: 0x00af0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: apdproxy.exe (PID: 1868) Address: 0x00bc0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: ehSched.exe (PID: 1920) Address: 0x00630000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: ehSched.exe (PID: 1920) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: realsched.exe (PID: 1928) Address: 0x00a90000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: realsched.exe (PID: 1928) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: mim.exe (PID: 1916) Address: 0x00ae0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: mim.exe (PID: 1916) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: jqs.exe (PID: 400) Address: 0x00760000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: jqs.exe (PID: 400) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: iTunesHelper.exe (PID: 396) Address: 0x00be0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: iTunesHelper.exe (PID: 396) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgrsx.exe (PID: 572) Address: 0x00770000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgrsx.exe (PID: 572) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: avgnsx.exe (PID: 1008) Address: 0x007d0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: avgnsx.exe (PID: 1008) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: isuspm.exe (PID: 2544) Address: 0x00ac0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: isuspm.exe (PID: 2544) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 2896) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 2896) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: svchost.exe (PID: 3000) Address: 0x007e0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: svchost.exe (PID: 3000) Address: 0x00890000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: mcrdsvc.exe (PID: 3212) Address: 0x00680000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: mcrdsvc.exe (PID: 3212) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: explorer.exe (PID: 3460) Address: 0x00c60000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: explorer.exe (PID: 3460) Address: 0x00d90000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: dllhost.exe (PID: 3744) Address: 0x006d0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: dllhost.exe (PID: 3744) Address: 0x007a0000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: alg.exe (PID: 4000) Address: 0x00820000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: alg.exe (PID: 4000) Address: 0x00750000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: iPodService.exe (PID: 2452) Address: 0x00870000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: iPodService.exe (PID: 2452) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 896) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 896) Address: 0x00b70000 Size: 45056
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: AcroRd32.exe (PID: 2220) Address: 0x00a80000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: AcroRd32.exe (PID: 2220) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: RootRepeal.exe (PID: 3856) Address: 0x00ef0000 Size: 45056
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: RootRepeal.exe (PID: 3856) Address: 0x10000000 Size: 40960
Object: Hidden Module [Name: UACdqbwuljiufvoqvf.dll]
Process: Iexplore.exe (PID: 3540) Address: 0x00aa0000 Size: 40960
Object: Hidden Module [Name: UACbqhqbcrgeoxujrk.dll]
Process: Iexplore.exe (PID: 3540) Address: 0x00b70000 Size: 45056
Hidden Services
-------------------
Service Name: UACd.sys
Image Path: C:\WINDOWS\system32\drivers\UACbqhohxllldbbaom.sys
Also...A RootRepeal Error window popped up when scan was done that said: Could not get our real service table pointers!
Details--Warning - the number of SSDT entries from the kernel and the number on-disk are different (284 and 0)