GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-04-01 23:57:22 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T1L0-5 ST3160815AS rev.3.AAD 149,05GB Running: r0t9v9i5.exe; Driver: C:\Users\BAMBAM~1\AppData\Local\Temp\pgrdqpoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075861401 2 bytes JMP 75bcb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075861419 2 bytes JMP 75bcb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075861431 2 bytes JMP 75c48ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007586144a 2 bytes CALL 75ba48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758614dd 2 bytes JMP 75c487a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758614f5 2 bytes JMP 75c48978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007586150d 2 bytes JMP 75c48698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075861525 2 bytes JMP 75c48a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007586153d 2 bytes JMP 75bbfca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075861555 2 bytes JMP 75bc68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007586156d 2 bytes JMP 75c48f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075861585 2 bytes JMP 75c48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007586159d 2 bytes JMP 75c4865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758615b5 2 bytes JMP 75bbfd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758615cd 2 bytes JMP 75bcb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758616b2 2 bytes JMP 75c48e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\GIGABYTE\Smart6\Timelock\TimeMgmtDaemon.exe[1792] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758616bd 2 bytes JMP 75c485f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2176] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 0000000077b7000c 1 byte [C3] .text C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[2176] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 0000000077bff8ea 5 bytes JMP 0000000177bad5c1 .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075861401 2 bytes JMP 75bcb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075861419 2 bytes JMP 75bcb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075861431 2 bytes JMP 75c48ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007586144a 2 bytes CALL 75ba48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000758614dd 2 bytes JMP 75c487a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000758614f5 2 bytes JMP 75c48978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007586150d 2 bytes JMP 75c48698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075861525 2 bytes JMP 75c48a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007586153d 2 bytes JMP 75bbfca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075861555 2 bytes JMP 75bc68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007586156d 2 bytes JMP 75c48f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075861585 2 bytes JMP 75c48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007586159d 2 bytes JMP 75c4865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000758615b5 2 bytes JMP 75bbfd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000758615cd 2 bytes JMP 75bcb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000758616b2 2 bytes JMP 75c48e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe[2420] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000758616bd 2 bytes JMP 75c485f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075861401 2 bytes JMP 75bcb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075861419 2 bytes JMP 75bcb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075861431 2 bytes JMP 75c48ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007586144a 2 bytes CALL 75ba48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000758614dd 2 bytes JMP 75c487a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000758614f5 2 bytes JMP 75c48978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007586150d 2 bytes JMP 75c48698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075861525 2 bytes JMP 75c48a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007586153d 2 bytes JMP 75bbfca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075861555 2 bytes JMP 75bc68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007586156d 2 bytes JMP 75c48f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075861585 2 bytes JMP 75c48ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007586159d 2 bytes JMP 75c4865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000758615b5 2 bytes JMP 75bbfd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000758615cd 2 bytes JMP 75bcb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000758616b2 2 bytes JMP 75c48e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Total Commander\TOTALCMD.EXE[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000758616bd 2 bytes JMP 75c485f1 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [5044] entry point in ".rdata" section 00000000667b71e6 ---- Processes - GMER 2.1 ---- Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 0000000074950000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000074660000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420](2015-03-04 22:08:06) 0000000074540000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000073f80000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (ICU I18N DLL/The ICU Project)(2015-03-04 22:08:06) 000000004a900000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (ICU Common DLL/The ICU Project)(2015-03-04 22:08:06) 00000000045c0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (ICU Data DLL/The ICU Project)(2015-03-04 22:08:06) 000000004ad00000 Library c:\users\bambam~1\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpoigsxu.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420](2015-04-01 20:37:14) 00000000041b0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 00000000720d0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 000000006e140000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000071eb0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000071c50000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000071c10000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420](2015-03-04 22:08:06) 0000000071c00000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:46) 0000000071b50000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000071ae0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 22:07:44) 0000000071a90000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420](2015-03-04 22:08:06) 00000000719b0000 Library C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Bambamdilla\AppData\Roaming\Dropbox\bin\Dropbox.exe [2420](2015-03-04 22:07:48) 00000000709a0000 ---- Files - GMER 2.1 ---- File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\7DDD996080AC00490E40A570889363F9D1914171 1388 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\767D6D2A504B5239ED8A21747349DC4D178D4EFD 1442 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\883B6096CBF15E56D535FCA1457A7892DF2081D1 1424 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\A6854CFC7A55B4633604265A9F6A14793750457A 1374 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\EFCFD962199D5D2B41B04F246382554F06DE2042 1447 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\83BD1F653FF7AA17A4BE922D4D0E569D84EC173D 1413 bytes File C:\Users\Bambamdilla\AppData\Local\Mozilla\Firefox\Profiles\2vacih9u.default-1427913404045\cache2\entries\60136B7AAAF76F0A86FB424FC26F1D289D0196E2 1456 bytes ---- EOF - GMER 2.1 ----