GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-02-20 00:44:04 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GT00 465,76GB Running: wytqqssz.exe; Driver: C:\Users\ALEKSA~1\AppData\Local\Temp\awpyakow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755e1401 2 bytes JMP 7526b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755e1419 2 bytes JMP 7526b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755e1431 2 bytes JMP 752e8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755e144a 2 bytes CALL 752448ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755e14dd 2 bytes JMP 752e87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755e14f5 2 bytes JMP 752e8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755e150d 2 bytes JMP 752e8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755e1525 2 bytes JMP 752e8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755e153d 2 bytes JMP 7525fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755e1555 2 bytes JMP 752668ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755e156d 2 bytes JMP 752e8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755e1585 2 bytes JMP 752e8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755e159d 2 bytes JMP 752e865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755e15b5 2 bytes JMP 7525fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755e15cd 2 bytes JMP 7526b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755e16b2 2 bytes JMP 752e8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[3092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755e16bd 2 bytes JMP 752e85f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Microsoft Antimalware\Definition Updates\{80773798-2D7F-4418-ACE1-92C5D1813CEE}\offreg.dll (*** suspicious ***) @ C:\Program Files\Microsoft Security Client\Antimalware\MsMpEng.exe [884](2015-02-18 18:40:14) 000007fee46c0000 Library C:\ProgramData\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\OnlineUpdate\ouc.exe [1908](2012-02-22 14:37:26) 000000006fbc0000 Library C:\ProgramData\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\OnlineUpdate\ouc.exe [1908](2012-02-22 14:37:26) 000000006e940000 Library C:\ProgramData\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\OnlineUpdate\ouc.exe [1908](2012-02-22 14:37:26) 000000006a1c0000 Library C:\ProgramData\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\OnlineUpdate\ouc.exe [1908](2012-02-22 14:37:27) 000000006ff00000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000] 000000006fbc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000](2012-11-16 20:55:18) 000000006e940000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000](2 000000006a1c0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000](2012-11-16 20:55:19) 000000006ff00000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000](2012-11-16 20:55:19) 000000006efc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2000](201 000000006ed40000 ---- Files - GMER 2.1 ---- File C:\ProgramData\Microsoft\Microsoft Antimalware\Scans\FailTelemetry\422F38E3D8C17C408E07519BD6A3D844 0 bytes ---- EOF - GMER 2.1 ----