GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-05 16:53:35 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\0000002e ST500LM012_HN-M500MBB rev.2AR10002 465,76GB Running: nh1gyuqn.exe; Driver: C:\Users\me\AppData\Local\Temp\pxlorpow.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\atiesrxx.exe[904] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\atiesrxx.exe[904] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\atieclxx.exe[1236] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\atieclxx.exe[1236] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\atieclxx.exe[1236] C:\Windows\system32\WSOCK32.dll!recvfrom + 742 000007f8fcdc1b32 4 bytes [DC, FC, F8, 07] .text C:\Windows\system32\atieclxx.exe[1236] C:\Windows\system32\WSOCK32.dll!recvfrom + 750 000007f8fcdc1b3a 4 bytes [DC, FC, F8, 07] .text C:\Windows\System32\spoolsv.exe[1536] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Windows\System32\spoolsv.exe[1536] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\svchost.exe[2072] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Windows\system32\svchost.exe[2072] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Windows\System32\igfxpers.exe[3740] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Windows\System32\igfxpers.exe[3740] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe[3792] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 306 000007f90210177a 4 bytes [10, 02, F9, 07] .text C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe[3792] C:\Windows\system32\PSAPI.DLL!GetProcessImageFileNameA + 314 000007f902101782 4 bytes [10, 02, F9, 07] .text C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 690 000007f8fc421532 4 bytes [42, FC, F8, 07] .text C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!GradientFill + 698 000007f8fc42153a 4 bytes [42, FC, F8, 07] .text C:\Program Files\HP\HP Deskjet 3520 series\Bin\ScanToPCActivationApp.exe[3792] C:\Windows\SYSTEM32\MSIMG32.dll!TransparentBlt + 246 000007f8fc42165a 4 bytes [42, FC, F8, 07] ? C:\Windows\SYSTEM32\BsHelpCSps.dll [4072] entry point in ".data" section 0000000003ed5055 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\csrss.exe [600:624] fffff960009235e8 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----