GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-01-21 21:08:11
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 KINGSTON_SV300S37A120G rev.505ABBF1 111,79GB
Running: eefv40hp.exe; Driver: C:\Users\Robert\AppData\Local\Temp\uwrdypob.sys


---- User code sections - GMER 2.1 ----

.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                                                        0000000076a41401 2 bytes JMP 76c5b21b C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                                                          0000000076a41419 2 bytes JMP 76c5b346 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                                                        0000000076a41431 2 bytes JMP 76cd8ea9 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                                                        0000000076a4144a 2 bytes CALL 76c348ad C:\Windows\syswow64\kernel32.dll
.text    ...                                                                                                                                                                                                                                * 9
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                                                           0000000076a414dd 2 bytes JMP 76cd87a2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                                                    0000000076a414f5 2 bytes JMP 76cd8978 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                                                           0000000076a4150d 2 bytes JMP 76cd8698 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                                                    0000000076a41525 2 bytes JMP 76cd8a62 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                                                          0000000076a4153d 2 bytes JMP 76c4fca8 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                                                               0000000076a41555 2 bytes JMP 76c568ef C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                                                        0000000076a4156d 2 bytes JMP 76cd8f61 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                                                          0000000076a41585 2 bytes JMP 76cd8ac2 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                                                             0000000076a4159d 2 bytes JMP 76cd865c C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                                                          0000000076a415b5 2 bytes JMP 76c4fd41 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                                                        0000000076a415cd 2 bytes JMP 76c5b2dc C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                                                    0000000076a416b2 2 bytes JMP 76cd8e24 C:\Windows\syswow64\kernel32.dll
.text    C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe[1632] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                                                    0000000076a416bd 2 bytes JMP 76cd85f1 C:\Windows\syswow64\kernel32.dll
.text    C:\Program Files\AVAST Software\Avast\AvastUI.exe[2160] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                                                               0000000076c38791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]

---- Threads - GMER 2.1 ----

Thread   C:\Windows\System32\svchost.exe [2392:4712]                                                                                                                                                                                        000007feef479688
---- Processes - GMER 2.1 ----

Process  C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe (*** suspicious ***) @ C:\ProgramData\WindowsMangerProtect\ProtectWindowsManager.exe [1632] (Windows SysTool  Service/SysTool PasSame LIMITED)(2015-01-17 22:46:31)  0000000000020000

---- EOF - GMER 2.1 ----