GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-11 10:28:57 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GS00 465,76GB Running: 2o5nox0m.exe; Driver: C:\Users\BASIA\AppData\Local\Temp\uwddqpod.sys ---- User code sections - GMER 2.1 ---- ? C:\Windows\system32\mssprxy.dll [2156] entry point in ".rdata" section 00000000715d71e6 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075401401 2 bytes JMP 7564b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075401419 2 bytes JMP 7564b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075401431 2 bytes JMP 756c8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007540144a 2 bytes CALL 7562489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000754014dd 2 bytes JMP 756c8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000754014f5 2 bytes JMP 756c89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007540150d 2 bytes JMP 756c8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075401525 2 bytes JMP 756c8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007540153d 2 bytes JMP 7563fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075401555 2 bytes JMP 756468ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007540156d 2 bytes JMP 756c8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075401585 2 bytes JMP 756c8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007540159d 2 bytes JMP 756c86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000754015b5 2 bytes JMP 7563fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000754015cd 2 bytes JMP 7564b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000754016b2 2 bytes JMP 756c8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3476] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000754016bd 2 bytes JMP 756c8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075401401 2 bytes JMP 7564b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075401419 2 bytes JMP 7564b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075401431 2 bytes JMP 756c8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007540144a 2 bytes CALL 7562489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000754014dd 2 bytes JMP 756c8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000754014f5 2 bytes JMP 756c89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007540150d 2 bytes JMP 756c8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075401525 2 bytes JMP 756c8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007540153d 2 bytes JMP 7563fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075401555 2 bytes JMP 756468ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007540156d 2 bytes JMP 756c8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075401585 2 bytes JMP 756c8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007540159d 2 bytes JMP 756c86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000754015b5 2 bytes JMP 7563fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000754015cd 2 bytes JMP 7564b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000754016b2 2 bytes JMP 756c8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[5356] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000754016bd 2 bytes JMP 756c8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075401401 2 bytes JMP 7564b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075401419 2 bytes JMP 7564b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075401431 2 bytes JMP 756c8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007540144a 2 bytes CALL 7562489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000754014dd 2 bytes JMP 756c8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000754014f5 2 bytes JMP 756c89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007540150d 2 bytes JMP 756c8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075401525 2 bytes JMP 756c8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007540153d 2 bytes JMP 7563fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075401555 2 bytes JMP 756468ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007540156d 2 bytes JMP 756c8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075401585 2 bytes JMP 756c8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007540159d 2 bytes JMP 756c86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000754015b5 2 bytes JMP 7563fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000754015cd 2 bytes JMP 7564b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000754016b2 2 bytes JMP 756c8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe[6088] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000754016bd 2 bytes JMP 756c8671 C:\Windows\syswow64\kernel32.dll .text D:\Avast\avastui.exe[3688] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075628781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] ---- Processes - GMER 2.1 ---- Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [1512] (GG drive overlay/GG Network S.A.)(2014-01-24 08:08:34) 000000005c080000 Library C:\Users\BASIA\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [1512] (GG drive menu/GG Network S.A.)(201 000000005ff80000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724] 000000006fbc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724](2013-01-19 08:46:12) 000000006e940000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724](2 000000006a1c0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724](2013-01-19 08:46:12) 000000006ff00000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724](2013-01-19 08:46:12) 000000006efc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2724](201 000000006ed40000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00150079fe36 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093665d4a Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093665d4a@f48e099224a1 0xBE 0xB9 0x11 0x19 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4c8093665d4a@c064c662e32a 0x90 0x6D 0x18 0x85 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00150079fe36 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093665d4a (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093665d4a@f48e099224a1 0xBE 0xB9 0x11 0x19 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4c8093665d4a@c064c662e32a 0x90 0x6D 0x18 0x85 ... ---- EOF - GMER 2.1 ----