GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-06-03 22:21:39 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MJA2500BH_G2 rev.8919 465,76GB Running: sd5m8m5x.exe; Driver: C:\Users\maciej\AppData\Local\Temp\kwrdrpog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075988769 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000755d1401 2 bytes JMP 759ab1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000755d1419 2 bytes JMP 759ab31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000755d1431 2 bytes JMP 75a28f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000755d144a 2 bytes CALL 75984885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000755d14dd 2 bytes JMP 75a28802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755d14f5 2 bytes JMP 75a289d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000755d150d 2 bytes JMP 75a286f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000755d1525 2 bytes JMP 75a28ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000755d153d 2 bytes JMP 7599fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000755d1555 2 bytes JMP 759a68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000755d156d 2 bytes JMP 75a28fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000755d1585 2 bytes JMP 75a28b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000755d159d 2 bytes JMP 75a286bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000755d15b5 2 bytes JMP 7599fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000755d15cd 2 bytes JMP 759ab2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000755d16b2 2 bytes JMP 75a28e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2636] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000755d16bd 2 bytes JMP 75a28651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755d1401 2 bytes JMP 759ab1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755d1419 2 bytes JMP 759ab31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755d1431 2 bytes JMP 75a28f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755d144a 2 bytes CALL 75984885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755d14dd 2 bytes JMP 75a28802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755d14f5 2 bytes JMP 75a289d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755d150d 2 bytes JMP 75a286f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755d1525 2 bytes JMP 75a28ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755d153d 2 bytes JMP 7599fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755d1555 2 bytes JMP 759a68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755d156d 2 bytes JMP 75a28fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755d1585 2 bytes JMP 75a28b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755d159d 2 bytes JMP 75a286bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755d15b5 2 bytes JMP 7599fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755d15cd 2 bytes JMP 759ab2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755d16b2 2 bytes JMP 75a28e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe[3668] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755d16bd 2 bytes JMP 75a28651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000755d1401 2 bytes JMP 759ab1ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000755d1419 2 bytes JMP 759ab31a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000755d1431 2 bytes JMP 75a28f09 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000755d144a 2 bytes CALL 75984885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755d14dd 2 bytes JMP 75a28802 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755d14f5 2 bytes JMP 75a289d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000755d150d 2 bytes JMP 75a286f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000755d1525 2 bytes JMP 75a28ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000755d153d 2 bytes JMP 7599fc78 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000755d1555 2 bytes JMP 759a68bf C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000755d156d 2 bytes JMP 75a28fc1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000755d1585 2 bytes JMP 75a28b22 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000755d159d 2 bytes JMP 75a286bc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755d15b5 2 bytes JMP 7599fd11 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755d15cd 2 bytes JMP 759ab2b0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755d16b2 2 bytes JMP 75a28e84 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755d16bd 2 bytes JMP 75a28651 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000741511a8 2 bytes [15, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 248 000000007415127d 2 bytes CALL 759814b9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 395 0000000074151310 2 bytes CALL 759814b9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000741513a8 2 bytes [15, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000074151422 2 bytes [15, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[19316] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000074151498 2 bytes [15, 74] ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006fbc0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006e940000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006a1c0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006ff00000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006efc0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [3000](2012-09-20 18:56:15) 000000006ed40000 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- Files - GMER 2.1 ---- File C:\Windows\Temp\SEP4E64.tmp 0 bytes ---- EOF - GMER 2.1 ----