GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-30 19:54:07 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ADATA_SP920SS rev.MU01 119,24GB Running: 7q6f64yw.exe; Driver: C:\Users\Piotr\AppData\Local\Temp\kflcapob.sys ---- User code sections - GMER 2.1 ---- .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075258781 4 bytes [C2, 04, 00, 00] .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text D:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Updater\Updater.exe[2036] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000777e000c 1 byte [C3] .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007786fbaa 5 bytes JMP 0000000177829cfb .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3316] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[3332] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000777e000c 1 byte [C3] .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007786fbaa 5 bytes JMP 0000000177829cfb .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\SysWOW64\ntdll.dll!DbgBreakPoint 00000000777e000c 1 byte [C3] .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\SysWOW64\ntdll.dll!DbgUiRemoteBreakin 000000007786fbaa 5 bytes JMP 0000000177829cfb .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075dc1401 2 bytes JMP 7527b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075dc1419 2 bytes JMP 7527b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075dc1431 2 bytes JMP 752f8f29 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075dc144a 2 bytes CALL 7525489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075dc14dd 2 bytes JMP 752f8822 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075dc14f5 2 bytes JMP 752f89f8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075dc150d 2 bytes JMP 752f8718 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075dc1525 2 bytes JMP 752f8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075dc153d 2 bytes JMP 7526fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075dc1555 2 bytes JMP 752768ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075dc156d 2 bytes JMP 752f8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075dc1585 2 bytes JMP 752f8b42 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075dc159d 2 bytes JMP 752f86dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075dc15b5 2 bytes JMP 7526fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075dc15cd 2 bytes JMP 7527b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075dc16b2 2 bytes JMP 752f8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Piotr\AppData\Roaming\Spotify\Spotify.exe[4184] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075dc16bd 2 bytes JMP 752f8671 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2832] 000007fef6480000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (*** suspicious ***) @ D:\Program Files\ESET\ESET Smart Security\egui.exe [3084] 000007fef6480000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\DropboxExt.26.dll (*** suspicious ***) @ C:\Program Files (x86)\Skype\Phone\Skype.exe [3332] 0000000069f30000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\DropboxExt64.26.dll (*** suspicious ***) @ D:\Program Files (x86)\i-Funbox DevTeam\iFunBox_x64.exe [3360] 000007fef6480000 Library c:\users\piotr\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpztu0mi.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] 0000000003280000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:24) 0000000073fb0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] 000000004a900000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] 0000000005fc0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] 000000004ad00000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:28) 0000000073b00000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006ca90000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 000000006c9d0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006c7f0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006b800000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006b5e0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006b380000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 0000000073a90000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 0000000073a80000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:28) 000000006b350000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006b310000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-03-04 21:45:26) 000000006b2c0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 000000006b1a0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 000000006b150000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\QtQuick.2\qtquick2plugin.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 0000000064fe0000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\QtQuick\Controls\qtquickcontrolsplugin.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 0000000063540000 Library C:\Users\Piotr\AppData\Roaming\Dropbox\bin\QtQuick\Window.2\windowplugin.dll (*** suspicious ***) @ C:\Users\Piotr\AppData\Roaming\Dropbox\bin\Dropbox.exe [3448](2015-03-04 21:45:30) 0000000064fd0000 ---- EOF - GMER 2.1 ----