GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-10-30 22:48:22 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST1000LM024_HN-M101MBB rev.2AR10001 931,51GB Running: 7ir24qfl.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uwddakob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000757f1401 2 bytes JMP 7599b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000757f1419 2 bytes JMP 7599b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000757f1431 2 bytes JMP 75a18ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000757f144a 2 bytes CALL 759748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757f14dd 2 bytes JMP 75a187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757f14f5 2 bytes JMP 75a18978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000757f150d 2 bytes JMP 75a18698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000757f1525 2 bytes JMP 75a18a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000757f153d 2 bytes JMP 7598fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000757f1555 2 bytes JMP 759968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000757f156d 2 bytes JMP 75a18f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000757f1585 2 bytes JMP 75a18ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000757f159d 2 bytes JMP 75a1865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757f15b5 2 bytes JMP 7598fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757f15cd 2 bytes JMP 7599b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757f16b2 2 bytes JMP 75a18e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\WinZipper\winzipersvc.exe[1256] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757f16bd 2 bytes JMP 75a185f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 00000000757f1401 2 bytes JMP 7599b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 00000000757f1419 2 bytes JMP 7599b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 00000000757f1431 2 bytes JMP 75a18ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 00000000757f144a 2 bytes CALL 759748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000757f14dd 2 bytes JMP 75a187a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000757f14f5 2 bytes JMP 75a18978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 00000000757f150d 2 bytes JMP 75a18698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 00000000757f1525 2 bytes JMP 75a18a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 00000000757f153d 2 bytes JMP 7598fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 00000000757f1555 2 bytes JMP 759968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 00000000757f156d 2 bytes JMP 75a18f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 00000000757f1585 2 bytes JMP 75a18ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 00000000757f159d 2 bytes JMP 75a1865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000757f15b5 2 bytes JMP 7598fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000757f15cd 2 bytes JMP 7599b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000757f16b2 2 bytes JMP 75a18e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Dtella@MS\dtella.exe[2560] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000757f16bd 2 bytes JMP 75a185f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2072] (GG drive overlay/GG Network S.A.)(2014-07-14 07:31:08) 000000005c080000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\24fd529e0b87 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\24fd529e0b87 (not active ControlSet) ---- Files - GMER 2.1 ---- File C:\Windows\System32\wdi\{533a67eb-9fb5-473d-b884-958cf4b9c4a3}\{b5e6b974-f0e5-4633-a2a7-020014f9cc3a} 0 bytes File C:\Windows\System32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\{94a6bc43-8aed-48b9-b866-dfa840e998de} 0 bytes File C:\Windows\System32\wdi\{ffc42108-4920-4acf-a4fc-8abdcc68ada4}\{b5159e20-2de5-4a23-9683-81951946b216} 0 bytes File C:\Users\Admin\AppData\Local\Mozilla\Firefox\Profiles\tn6mwzn8.default\cache2\entries\8DB2A250BB486C41527AF2DEFF04970938395500 252 bytes ---- EOF - GMER 2.1 ----