GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-04-16 14:41:49 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006d ST932032 rev.0002 298,09GB Running: z59f1if1.exe; Driver: C:\Users\Krysia\AppData\Local\Temp\kftcqaow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000104c00 7 bytes [00, 93, F3, FF, 41, A4, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000104c08 3 bytes [00, 07, 02] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075261401 2 bytes JMP 76c0b1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075261419 2 bytes JMP 76c0b31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075261431 2 bytes JMP 76c88f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007526144a 2 bytes CALL 76be4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000752614dd 2 bytes JMP 76c88802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000752614f5 2 bytes JMP 76c889d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007526150d 2 bytes JMP 76c886f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075261525 2 bytes JMP 76c88ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007526153d 2 bytes JMP 76bffc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075261555 2 bytes JMP 76c068bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007526156d 2 bytes JMP 76c88fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075261585 2 bytes JMP 76c88b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007526159d 2 bytes JMP 76c886bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000752615b5 2 bytes JMP 76bffd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000752615cd 2 bytes JMP 76c0b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000752616b2 2 bytes JMP 76c88e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1540] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000752616bd 2 bytes JMP 76c88651 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075261401 2 bytes JMP 76c0b1ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075261419 2 bytes JMP 76c0b31a C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075261431 2 bytes JMP 76c88f09 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007526144a 2 bytes CALL 76be4885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000752614dd 2 bytes JMP 76c88802 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000752614f5 2 bytes JMP 76c889d8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007526150d 2 bytes JMP 76c886f8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075261525 2 bytes JMP 76c88ac2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007526153d 2 bytes JMP 76bffc78 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075261555 2 bytes JMP 76c068bf C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007526156d 2 bytes JMP 76c88fc1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075261585 2 bytes JMP 76c88b22 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007526159d 2 bytes JMP 76c886bc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000752615b5 2 bytes JMP 76bffd11 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000752615cd 2 bytes JMP 76c0b2b0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000752616b2 2 bytes JMP 76c88e84 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\Fast Boot\FastBootAgent.exe[1612] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000752616bd 2 bytes JMP 76c88651 C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.1 ---- Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4092:900] 000007fefb2b2bf8 ---- Processes - GMER 2.1 ---- Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [1944](2 000000006a1c0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [1944] 000000006fbc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [1944](2014-07-29 18:58:31) 000000006e940000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [1944](2014-07-29 18:58:31) 000000006ff00000 ---- Files - GMER 2.1 ---- File C:\ADSM_PData_0150 0 bytes File C:\ADSM_PData_0150\DB 0 bytes File C:\ADSM_PData_0150\DB\SI.db 624 bytes File C:\ADSM_PData_0150\DB\UL.db 16 bytes File C:\ADSM_PData_0150\DB\VL.db 16 bytes File C:\ADSM_PData_0150\DB\WAL.db 2048 bytes File C:\ADSM_PData_0150\DragWait.exe 315392 bytes executable File C:\ADSM_PData_0150\_avt 512 bytes ---- EOF - GMER 2.1 ----