Avast drivers

(avast! Virtualization Driver/AVAST Software) ZwOpenMutant [0xAA6C83D8]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenProcess [0xAA6C8680]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSection [0xAA6C853E]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenSemaphore [0xAA6C842E]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenThread [0xAA6C8764]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenTimer [0xAA6C859C]SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwProtectVirtualMemory [0xAB116658]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryKey [0xAA6E98C0]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryObject [0xAA6C696A]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwQueryValueKey [0xAA6E9712]SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwRenameKey [0xAB11E9E6]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwRestoreKey [0xAA6E86D0]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootEntryOrder [0xAA6C6030]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetBootOptions [0xAA6C6054]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemInformation [0xAA6C5E0C]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetSystemPowerState [0xAA6C5F48]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSetValueKey [0xAA6E9E76]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwShutdownSystem [0xAA6C5F24]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwSystemDebugControl [0xAA6C5F6C]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwVdmControl [0xAA6C6078]Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwCreateProcessEx [0xAB12A7A2]Code \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObInsertObjectCode \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ObMakeTemporaryObject---- Kernel code sections - GMER 1.0.15 ----.text ntkrnlpa.exe!ZwCallbackReturn + 2CB8 80504544 4 Bytes CALL ACFAB1A8 .text ntkrnlpa.exe!ZwCallbackReturn + 2EC4 80504750 4 Bytes JMP D882F266 .text ntkrnlpa.exe!ZwCallbackReturn + 2F10 8050479C 5 Bytes [30, 60, 6C, AA, 54] {XOR [EAX+0x6c], AH; STOSB ; PUSH ESP}.text ntkrnlpa.exe!ZwCallbackReturn + 2F16 805047A2 2 Bytes [6C, AA] {INSB ; STOSB }PAGE ntkrnlpa.exe!ZwReplyWaitReceivePortEx + 5EC 805A648C 4 Bytes CALL AA6C700F \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)PAGE ntkrnlpa.exe!ObMakeTemporaryObject 805BC512 5 Bytes JMP AB12769C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)PAGE ntkrnlpa.exe!ObInsertObject 805C2F96 5 Bytes JMP AB12915C \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)PAGE ntkrnlpa.exe!ZwCreateProcessEx 805D1136 7 Bytes JMP AB12A7A6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software).text C:\WINDOWS\system32\DRIVERS\ati2mtag.sys section is writeable [0xB8E1B000, 0x1C5D38, 0xE8000020].text win32k.sys!BRUSHOBJ_pvAllocRbrush + 320C BF81E743 5 Bytes JMP AA6C8AD6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngSetLastError + 7657 BF82868B 5 Bytes JMP AA6C8B9A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text

NTFS========================= Users: ========================================User accounts for \\CTU-MAINFRAMEAdministrator ASPNET Guest HelpAssistant John SUPPORT_388945a0 **** End of log ****================================================================================================================================================================Malwarebytes' Anti-Malware 1.51.2.1300www.malwarebytes.orgDatabase version: 7622Windows 5.1.2600 Service Pack 3Internet Explorer 6.0.2900.55121/3/2012 11:37:47 AMmbam-log-2012-01-03 (11-37-47).txtScan type: Quick scanObjects scanned: 189693Time elapsed: 7 minute(s), 53 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)================================================================================================================================================================GMER 1.0.15.15641 - scan 2012-01-03 13:33:34Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Scsi\nvgts1Port2Path0Target0Lun0 Maxtor_6 rev.NAN5Running: 0u2lzmqd.exe; Driver: C:\DOCUME~1\John\LOCALS~1\Temp\kwtyiuoc.sys---- System - GMER 1.0.15 ----SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwAddBootEntry [0xAA6C5FC4]SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwAllocateVirtualMemory [0xAB116510]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwClose [0xAA6E96A9]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEvent [0xAA6C8456]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateEventPair [0xAA6C84AE]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateIoCompletion [0xAA6C85C4]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateKey [0xAA6E905D]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateMutant [0xAA6C83AC]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSection [0xAA6C84FE]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateSemaphore [0xAA6C8400]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwCreateTimer [0xAA6C8572]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteBootEntry [0xAA6C5FE8]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteKey [0xAA6E9D6F]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDeleteValueKey [0xAA6EA025]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwDuplicateObject [0xAA6C8848]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateKey [0xAA6E9BDA]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwEnumerateValueKey [0xAA6E9A45]SSDT \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software) ZwFreeVirtualMemory [0xAB1165C0]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwLoadDriver [0xAA6C5DB2]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwModifyBootEntry [0xAA6C600C]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeKey [0xAA6C89BC]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwNotifyChangeMultipleKeys [0xAA6C6AA4]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEvent [0xAA6C8486]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenEventPair [0xAA6C84D6]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenIoCompletion [0xAA6C85EE]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software) ZwOpenKey [0xAA6E93B9]SSDT \SystemRoot\System32\Drivers\aswSnx.SYS

Win32k.sys!EngCreateBitmap + D9AB BF845873 5 Bytes JMP AA6C8C0A \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngMultiByteToWideChar + 2F20 BF8527E0 5 Bytes JMP AA6C8ABE \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngGetCurrentCodePage + 413A BF890AD9 5 Bytes JMP AA6C8F76 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngGradientFill + 4B52 BF8B3770 5 Bytes JMP AA6C8DE6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngGradientFill + 4BDD BF8B37FB 5 Bytes JMP AA6C8FBC \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngAlphaBlend + 9286 BF8C31E7 5 Bytes JMP AA6C8CA4 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!PATHOBJ_bCloseFigure + 19CE BF8ED991 5 Bytes JMP AA6C89F2 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!PATHOBJ_bCloseFigure + D4C6 BF8F9489 5 Bytes JMP AA6C8D14 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!PATHOBJ_bCloseFigure + D746 BF8F9709 5 Bytes JMP AA6C8D4E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngCreateClip + 1994 BF912612 5 Bytes JMP AA6C8B56 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngCreateClip + 2568 BF9131E6 5 Bytes JMP AA6C8C6E \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software).text win32k.sys!EngCreateClip + 4F29 BF915BA7 5 Bytes JMP AA6C90D6 \SystemRoot\System32\Drivers\aswSnx.SYS (avast! Virtualization Driver/AVAST Software)---- User code sections - GMER 1.0.15 ----.text C:\WINDOWS\Explorer.EXE[168] ntdll.dll!LdrLoadDll 7C9163A3 5 Bytes JMP 000901F8 .text C:\WINDOWS\Explorer.EXE[168] ntdll.dll!RtlDosSearchPath_U + 1D1 7C9171AA 1 Byte [62].text C:\WINDOWS\Explorer.EXE[168] ntdll.dll!LdrUnloadDll 7C91736B 5 Bytes JMP 000903FC .text C:\WINDOWS\Explorer.EXE[168] kernel32.dll!GetBinaryTypeW + 80 7C868C2C 1 Byte [62].text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!SetServiceObjectSecurity 77E36D59 5 Bytes JMP 002C1014 .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!ChangeServiceConfigA 77E36E41 5 Bytes JMP 002C0804 .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!ChangeServiceConfigW 77E36FD9 5 Bytes JMP 002C0A08 .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!ChangeServiceConfig2A 77E370D9 5 Bytes JMP 002C0C0C .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!ChangeServiceConfig2W 77E37161 5 Bytes JMP 002C0E10 .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!CreateServiceA 77E371E9 5 Bytes JMP 002C01F8 .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!CreateServiceW 77E37381 5 Bytes JMP 002C03FC .text C:\WINDOWS\Explorer.EXE[168] ADVAPI32.dll!DeleteService 77E37489 5 Bytes JMP 002C0600 .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 002D0804 .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 002D0A08 .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!SetWindowsHookExA 7E431211 5 Bytes JMP 002D0600 .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!SetWinEventHook 7E4317F7 5 Bytes JMP 002D01F8 .text C:\WINDOWS\Explorer.EXE[168] USER32.dll!UnhookWinEvent 7E4318AC 5 Bytes JMP 002D03FC .text C:\WINDOWS\system32\spoolsv.exe[196]