GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-08-31 12:38:01 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 298,09GB Running: l67916cj.exe; Driver: C:\Users\o\AppData\Local\Temp\axloyuog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075238769 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000768b1401 2 bytes JMP 7525b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000768b1419 2 bytes JMP 7525b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000768b1431 2 bytes JMP 752d8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000768b144a 2 bytes CALL 75234885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000768b14dd 2 bytes JMP 752d8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000768b14f5 2 bytes JMP 752d8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000768b150d 2 bytes JMP 752d8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000768b1525 2 bytes JMP 752d8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000768b153d 2 bytes JMP 7524fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000768b1555 2 bytes JMP 752568df C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000768b156d 2 bytes JMP 752d8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000768b1585 2 bytes JMP 752d8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000768b159d 2 bytes JMP 752d86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000768b15b5 2 bytes JMP 7524fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000768b15cd 2 bytes JMP 7525b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000768b16b2 2 bytes JMP 752d8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1460] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000768b16bd 2 bytes JMP 752d8681 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000768b1401 2 bytes JMP 7525b20b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000768b1419 2 bytes JMP 7525b336 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000768b1431 2 bytes JMP 752d8f39 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000768b144a 2 bytes CALL 75234885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000768b14dd 2 bytes JMP 752d8832 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000768b14f5 2 bytes JMP 752d8a08 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000768b150d 2 bytes JMP 752d8728 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000768b1525 2 bytes JMP 752d8af2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000768b153d 2 bytes JMP 7524fc98 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000768b1555 2 bytes JMP 752568df C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000768b156d 2 bytes JMP 752d8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000768b1585 2 bytes JMP 752d8b52 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000768b159d 2 bytes JMP 752d86ec C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000768b15b5 2 bytes JMP 7524fd31 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000768b15cd 2 bytes JMP 7525b2cc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000768b16b2 2 bytes JMP 752d8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[3388] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000768b16bd 2 bytes JMP 752d8681 C:\Windows\syswow64\kernel32.dll ---- User IAT/EAT - GMER 2.1 ---- IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord] [7fef223741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet] [7fef2235f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession] [7fef2235674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession] [7fef2235e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload] [7fef2237f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion] [7fef2236a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId] [7fef2236ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId] [7fef2237b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId] [7fef2237ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId] [7fef22378b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession] [7fef2234fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId] [7fef2235d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll IAT C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[900] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString] [7fef2237584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll ---- Services - GMER 2.1 ---- Service C:\Windows\system32 (*** hidden *** ) [MANUAL] BFE <-- ROOTKIT !!! ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde0679b9 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde0679b9@ecf35bcd632c 0x59 0x9C 0x0B 0xA1 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde0679b9@3017c80000b3 0x47 0xB9 0xF6 0x2E ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde0679b9 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde0679b9@ecf35bcd632c 0x59 0x9C 0x0B 0xA1 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde0679b9@3017c80000b3 0x47 0xB9 0xF6 0x2E ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----