GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-02-11 14:41:25 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_EVO_1TB rev.EXT0BB6Q 931,51GB Running: jhnmqgsg.exe; Driver: C:\Users\PAN\AppData\Local\Temp\pwldapow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000768d8791 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1876] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Sony\VCM Intelligent Analyzing Manager\VcmIAlzMgr.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\Explorer.EXE[3248] C:\Windows\system32\IMM32.dll!ImmProcessKey 000007fefdea39c8 14 bytes {JMP QWORD [RIP+0x0]} .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe[4044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[4036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe[4312] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[4560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\KeyScrambler\x64\KeyScrambler.exe[4620] C:\Windows\system32\IMM32.DLL!ImmProcessKey 000007fefdea39c8 14 bytes {JMP QWORD [RIP+0x0]} .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077b91401 2 bytes JMP 768fb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077b91419 2 bytes JMP 768fb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077b91431 2 bytes JMP 76978ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077b9144a 2 bytes CALL 768d48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077b914dd 2 bytes JMP 769787a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077b914f5 2 bytes JMP 76978978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077b9150d 2 bytes JMP 76978698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077b91525 2 bytes JMP 76978a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077b9153d 2 bytes JMP 768efca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077b91555 2 bytes JMP 768f68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077b9156d 2 bytes JMP 76978f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077b91585 2 bytes JMP 76978ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077b9159d 2 bytes JMP 7697865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077b915b5 2 bytes JMP 768efd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077b915cd 2 bytes JMP 768fb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077b916b2 2 bytes JMP 76978e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Sony Shared\VAIO Content Folder Watcher\VCFw.exe[2988] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077b916bd 2 bytes JMP 769785f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [3248] (GG drive overlay/GG Network S.A.)(2013-06-22 19:02:27) 000000005c080000 Library C:\Users\PAN\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [3248] (GG drive menu/GG Network S.A.)(2013-06 000000005ff80000 Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Program Files\ESET\ESET Smart Security\egui.exe [2908] (GG drive overlay/GG Network S.A.)(2013-06-22 19:02:27) 000000005c080000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46) 000000006cef0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 000000006cbb0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312](2014-10-22 00:22:50) 000000006b6a0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 000000006c6d0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (ICU I18N DLL/The ICU Project)(2014-10-22 00:22:50) 000000004a900000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (ICU Common DLL/The ICU Project)(2014-10-22 00:22:50) 0000000004580000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (ICU Data DLL/The ICU Project)(2014-10-22 00:22:50) 000000004ad00000 Library c:\users\pan\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp_ltfuw.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312](2015-02-11 12:56:22) 0000000003fb0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 0000000074180000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 0000000068e90000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 0000000073840000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 00000000735e0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:40) 0000000074150000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312](2014-10-22 00:22:50) 0000000074140000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:46) 0000000074110000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 00000000740d0000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2014-10-22 00:22:38) 0000000074080000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312](2014-10-22 00:22:48) 0000000073500000 Library C:\Users\PAN\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\PAN\AppData\Roaming\Dropbox\bin\Dropbox.exe [4312](2014-10-22 00:22:46) 0000000074040000 ---- EOF - GMER 2.1 ----