GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-05-12 18:11:43 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD1002FAEX-00Z3A0 rev.05.01D05 931,51GB Running: mb2hd6jc.exe; Driver: C:\Users\ALBI\AppData\Local\Temp\aftcqaoc.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000071d317fa 2 bytes CALL 77611199 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000071d31860 2 bytes CALL 77611199 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000071d31942 2 bytes JMP 7757c29f C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000071d3194d 2 bytes JMP 7757418d C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 7762eb26 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 7763b513 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 776b8609 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 77611dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 776b7efe C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 776b80d8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 776b7df4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 776b81c2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 7762f088 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000756e1555 2 bytes JMP 7763b885 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 776b86c1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 776b8222 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 776b7db8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 7762f121 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 7763b29f C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 776b8584 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3260] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 776b7d4d C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Saitek\VolumeTracker\SaiVolume.exe[3932] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Program Files\Saitek\VolumeTracker\SaiVolume.exe[3932] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Program Files\Saitek\VolumeTracker\SaiVolume.exe[3932] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files\SmartTechnology\Software\ProfilerU.exe[3944] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Program Files\SmartTechnology\Software\ProfilerU.exe[3944] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Program Files\SmartTechnology\Software\ProfilerU.exe[3944] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files\SmartTechnology\Software\SaiMfd.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Program Files\SmartTechnology\Software\SaiMfd.exe[3960] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Program Files\SmartTechnology\Software\SaiMfd.exe[3960] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3992] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3992] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3992] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3992] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000775c1bb2 5 bytes JMP 0000000100172dcc .text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe[4024] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe[4024] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Seagate\Seagate Dashboard 2.0\MobileService.exe[4024] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 7762eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 7763b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 776b8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 77611dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 776b7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 776b80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 776b7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 776b81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 7762f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000756e1555 2 bytes JMP 7763b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 776b86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 776b8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 776b7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 7762f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 7763b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 776b8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[4092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 776b7d4d C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\svchost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000177910128 .text C:\Windows\system32\svchost.exe[2120] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000177910018 .text C:\Windows\system32\svchost.exe[2120] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 00000000779100a0 .text C:\Program Files\Rainmeter\Rainmeter.exe[2968] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Program Files\Rainmeter\Rainmeter.exe[2968] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Program Files\Rainmeter\Rainmeter.exe[2968] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe[4036] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe[4036] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\ToolbarUpdater.exe[4036] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2064] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2064] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2064] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 7762eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 7763b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 776b8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 77611dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 776b7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 776b80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 776b7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 776b81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 7762f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000756e1555 2 bytes JMP 7763b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 776b86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 776b8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 776b7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 7762f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 7763b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 776b8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\vprot.exe[1476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 776b7d4d C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe[1484] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe[1484] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Splashtop\Splashtop Connect Firefox Software Updater\WCUService.exe[1484] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe[3924] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe[3924] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Common Files\AVG Secure Search\vToolbarUpdater\18.4.0\loggingserver.exe[3924] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Windows\system32\conhost.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Windows\system32\conhost.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Windows\system32\conhost.exe[3624] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe[3144] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe[3144] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Splashtop\Splashtop Connect IE Software Updater\WCUService.exe[3144] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3976] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3976] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[3976] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\xampp\apache\bin\httpd.exe[4100] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\xampp\apache\bin\httpd.exe[4100] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\xampp\apache\bin\httpd.exe[4100] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Windows\system32\wbem\wmiprvse.exe[4952] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Windows\system32\wbem\wmiprvse.exe[4952] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Windows\system32\wbem\wmiprvse.exe[4952] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Windows\system32\svchost.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000177910128 .text C:\Windows\system32\svchost.exe[5992] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000177910018 .text C:\Windows\system32\svchost.exe[5992] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 00000000779100a0 .text C:\Windows\system32\SearchIndexer.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000077ad0128 .text C:\Windows\system32\SearchIndexer.exe[6032] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000077ad0018 .text C:\Windows\system32\SearchIndexer.exe[6032] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Program Files\Windows Media Player\wmpnetwk.exe[6656] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 0000000077ad00a0 .text C:\Windows\SysWOW64\ctfmon.exe[7140] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Windows\SysWOW64\ctfmon.exe[7140] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Windows\SysWOW64\ctfmon.exe[7140] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Windows\System32\svchost.exe[6508] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 0000000077970130 5 bytes JMP 0000000177910128 .text C:\Windows\System32\svchost.exe[6508] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 0000000077970250 5 bytes JMP 0000000177910018 .text C:\Windows\System32\svchost.exe[6508] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007771a600 5 bytes JMP 00000000779100a0 .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 7762eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 7763b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 776b8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 77611dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 776b7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 776b80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 776b7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 776b81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 7762f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000756e1555 2 bytes JMP 7763b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 776b86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 776b8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 776b7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 7762f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 7763b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 776b8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG Web TuneUp\avgcefrend.exe[1108] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 776b7d4d C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1908] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077b1fbf0 5 bytes JMP 0000000170561460 .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1908] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077b1fdb4 5 bytes JMP 0000000170561120 .text C:\Program Files (x86)\Nero\Update\NASvc.exe[1908] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 000000007762117b 5 bytes JMP 0000000170561260 ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification ---- Processes - GMER 2.1 ---- Process C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE (*** suspicious ***) @ C:\ProgramData\EPSON\EPW!3 SSRP\E_S40RPB.EXE [2832] (EPSON Status Monitor 3/SEIKO EPSON CORPORATION)(2014-08-29 09:59:07) 0000000100000000 Library C:\Users\ALBI\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\Ontology.dll (*** suspicious ***) @ C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [3992] (Application Ontology library/NVIDIA Corporation)(2015-05-08 12:32:36) 0000000073c00000 ---- Registry - GMER 2.1 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\ALBI\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst\Need For Speed. Hot Pursuit\Íŕ\xf7ŕňü Čăđó.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\R.G. Catalyst\Need For Speed. Hot Pursuit\Íŕ\xf7ŕňü Čăđó.lnk 1 ---- EOF - GMER 2.1 ----