GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-12-02 22:55:51 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000065 rev. 0,00MB Running: pb8rbptw.exe; Driver: C:\Users\Karla\AppData\Local\Temp\pwlyypob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75b3b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75b3b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75bb8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75b148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75bb87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75bb8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75bb8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75bb8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75b2fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75b368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75bb8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75bb8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75bb865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75b2fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75b3b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75bb8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75bb85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75b3b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75b3b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75bb8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75b148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75bb87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75bb8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75bb8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75bb8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75b2fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75b368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75bb8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75bb8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75bb865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75b2fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75b3b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75bb8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[4084] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75bb85f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 00000000771c1401 2 bytes JMP 75b3b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17 00000000771c1419 2 bytes JMP 75b3b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17 00000000771c1431 2 bytes JMP 75bb8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42 00000000771c144a 2 bytes CALL 75b148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 00000000771c14dd 2 bytes JMP 75bb87a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 00000000771c14f5 2 bytes JMP 75bb8978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 00000000771c150d 2 bytes JMP 75bb8698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 00000000771c1525 2 bytes JMP 75bb8a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 00000000771c153d 2 bytes JMP 75b2fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17 00000000771c1555 2 bytes JMP 75b368ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 00000000771c156d 2 bytes JMP 75bb8f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 00000000771c1585 2 bytes JMP 75bb8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 00000000771c159d 2 bytes JMP 75bb865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 00000000771c15b5 2 bytes JMP 75b2fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 00000000771c15cd 2 bytes JMP 75b3b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 00000000771c16b2 2 bytes JMP 75bb8e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Karla\Downloads\OTL.exe[3736] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 00000000771c16bd 2 bytes JMP 75bb85f1 C:\Windows\syswow64\kernel32.dll ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 sector 0: rootkit-like behavior ---- EOF - GMER 2.1 ----