GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-11 19:14:22 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST964032 rev.0002 596,17GB Running: 53klxxt0.exe; Driver: C:\Users\Piotr\AppData\Local\Temp\awddrkog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075bd1401 2 bytes JMP 7669b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075bd1419 2 bytes JMP 7669b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075bd1431 2 bytes JMP 76718f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075bd144a 2 bytes CALL 7667489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075bd14dd 2 bytes JMP 76718822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075bd14f5 2 bytes JMP 767189f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075bd150d 2 bytes JMP 76718718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075bd1525 2 bytes JMP 76718ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075bd153d 2 bytes JMP 7668fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075bd1555 2 bytes JMP 766968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075bd156d 2 bytes JMP 76718fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075bd1585 2 bytes JMP 76718b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075bd159d 2 bytes JMP 767186dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075bd15b5 2 bytes JMP 7668fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075bd15cd 2 bytes JMP 7669b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075bd16b2 2 bytes JMP 76718ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\ProtectService.exe[1708] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075bd16bd 2 bytes JMP 76718671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076678781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075bd1401 2 bytes JMP 7669b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075bd1419 2 bytes JMP 7669b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075bd1431 2 bytes JMP 76718f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075bd144a 2 bytes CALL 7667489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075bd14dd 2 bytes JMP 76718822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075bd14f5 2 bytes JMP 767189f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075bd150d 2 bytes JMP 76718718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075bd1525 2 bytes JMP 76718ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075bd153d 2 bytes JMP 7668fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075bd1555 2 bytes JMP 766968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075bd156d 2 bytes JMP 76718fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075bd1585 2 bytes JMP 76718b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075bd159d 2 bytes JMP 767186dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075bd15b5 2 bytes JMP 7668fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075bd15cd 2 bytes JMP 7669b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075bd16b2 2 bytes JMP 76718ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3748] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075bd16bd 2 bytes JMP 76718671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075bd1401 2 bytes JMP 7669b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075bd1419 2 bytes JMP 7669b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075bd1431 2 bytes JMP 76718f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075bd144a 2 bytes CALL 7667489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075bd14dd 2 bytes JMP 76718822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075bd14f5 2 bytes JMP 767189f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075bd150d 2 bytes JMP 76718718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075bd1525 2 bytes JMP 76718ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075bd153d 2 bytes JMP 7668fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075bd1555 2 bytes JMP 766968ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075bd156d 2 bytes JMP 76718fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075bd1585 2 bytes JMP 76718b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075bd159d 2 bytes JMP 767186dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075bd15b5 2 bytes JMP 7668fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075bd15cd 2 bytes JMP 7669b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075bd16b2 2 bytes JMP 76718ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\MiuiTab\HPNotify.exe[6012] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075bd16bd 2 bytes JMP 76718671 C:\Windows\syswow64\kernel32.dll ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c4bd610429e Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\1c4bd610429e@70f9271cd5a9 0x23 0xA1 0x4F 0x18 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c4bd610429e (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\1c4bd610429e@70f9271cd5a9 0x23 0xA1 0x4F 0x18 ... ---- Files - GMER 2.1 ---- File C:\Windows\Temp\_avast_\ws10F3E6D8.dat 0 bytes ---- EOF - GMER 2.1 ----