GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-10-17 13:02:09 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\00000060 SAMSUNG_ rev.1AJ1 465,76GB Running: mhlz3458.exe; Driver: C:\Users\Atreyu\AppData\Local\Temp\pxldypog.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075b31401 2 bytes JMP 761beb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075b31419 2 bytes JMP 761cb513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075b31431 2 bytes JMP 76248609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075b3144a 2 bytes CALL 761a1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075b314dd 2 bytes JMP 76247efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075b314f5 2 bytes JMP 762480d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075b3150d 2 bytes JMP 76247df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075b31525 2 bytes JMP 762481c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075b3153d 2 bytes JMP 761bf088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075b31555 2 bytes JMP 761cb885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075b3156d 2 bytes JMP 762486c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075b31585 2 bytes JMP 76248222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075b3159d 2 bytes JMP 76247db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075b315b5 2 bytes JMP 761bf121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075b315cd 2 bytes JMP 761cb29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075b316b2 2 bytes JMP 76248584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\2dpainting.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075b316bd 2 bytes JMP 76247d4d C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 0000000075b31401 2 bytes JMP 761beb26 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17 0000000075b31419 2 bytes JMP 761cb513 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17 0000000075b31431 2 bytes JMP 76248609 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42 0000000075b3144a 2 bytes CALL 761a1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 0000000075b314dd 2 bytes JMP 76247efe C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 0000000075b314f5 2 bytes JMP 762480d8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 0000000075b3150d 2 bytes JMP 76247df4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 0000000075b31525 2 bytes JMP 762481c2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 0000000075b3153d 2 bytes JMP 761bf088 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17 0000000075b31555 2 bytes JMP 761cb885 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 0000000075b3156d 2 bytes JMP 762486c1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 0000000075b31585 2 bytes JMP 76248222 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 0000000075b3159d 2 bytes JMP 76247db8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 0000000075b315b5 2 bytes JMP 761bf121 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 0000000075b315cd 2 bytes JMP 761cb29f C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 0000000075b316b2 2 bytes JMP 76248584 C:\Windows\syswow64\kernel32.dll .text C:\Users\Atreyu\Downloads\OTL.exe[620] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 0000000075b316bd 2 bytes JMP 76247d4d C:\Windows\syswow64\kernel32.dll ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{52B84557-9E37-4851-ABBF-D0D34715A996}\mpengine.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2576] (Microsoft Malware Protection Engine/Microsoft Corporation)(2014-09-15 23:01:16) 000007fef6210000 ---- EOF - GMER 2.1 ----