GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-16 11:26:15 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PC4O 465,76GB Running: kgk.exe; Driver: C:\Users\Anka\AppData\Local\Temp\kxtdrpod.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077ab1401 2 bytes JMP 75eab21b C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077ab1419 2 bytes JMP 75eab346 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077ab1431 2 bytes JMP 75f28fd1 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077ab144a 2 bytes CALL 75e8489d C:\windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077ab14dd 2 bytes JMP 75f288c4 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077ab14f5 2 bytes JMP 75f28aa0 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077ab150d 2 bytes JMP 75f287ba C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077ab1525 2 bytes JMP 75f28b8a C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077ab153d 2 bytes JMP 75e9fca8 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077ab1555 2 bytes JMP 75ea68ef C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077ab156d 2 bytes JMP 75f29089 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077ab1585 2 bytes JMP 75f28bea C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077ab159d 2 bytes JMP 75f2877e C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077ab15b5 2 bytes JMP 75e9fd41 C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077ab15cd 2 bytes JMP 75eab2dc C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077ab16b2 2 bytes JMP 75f28f4c C:\windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Garmin\Core Update Service\Garmin.Cartography.MapUpdate.CoreService.exe[1888] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077ab16bd 2 bytes JMP 75f28713 C:\windows\syswow64\KERNEL32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077ab1401 2 bytes JMP 75eab21b C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077ab1419 2 bytes JMP 75eab346 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077ab1431 2 bytes JMP 75f28fd1 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077ab144a 2 bytes CALL 75e8489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077ab14dd 2 bytes JMP 75f288c4 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077ab14f5 2 bytes JMP 75f28aa0 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077ab150d 2 bytes JMP 75f287ba C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077ab1525 2 bytes JMP 75f28b8a C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077ab153d 2 bytes JMP 75e9fca8 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077ab1555 2 bytes JMP 75ea68ef C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077ab156d 2 bytes JMP 75f29089 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077ab1585 2 bytes JMP 75f28bea C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077ab159d 2 bytes JMP 75f2877e C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077ab15b5 2 bytes JMP 75e9fd41 C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077ab15cd 2 bytes JMP 75eab2dc C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077ab16b2 2 bytes JMP 75f28f4c C:\windows\syswow64\kernel32.dll .text C:\Users\Anka\AppData\Roaming\TSv\TSvr.exe[2000] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077ab16bd 2 bytes JMP 75f28713 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077ab1401 2 bytes JMP 75eab21b C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077ab1419 2 bytes JMP 75eab346 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077ab1431 2 bytes JMP 75f28fd1 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000077ab144a 2 bytes CALL 75e8489d C:\windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000077ab14dd 2 bytes JMP 75f288c4 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000077ab14f5 2 bytes JMP 75f28aa0 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000077ab150d 2 bytes JMP 75f287ba C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077ab1525 2 bytes JMP 75f28b8a C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000077ab153d 2 bytes JMP 75e9fca8 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077ab1555 2 bytes JMP 75ea68ef C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000077ab156d 2 bytes JMP 75f29089 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077ab1585 2 bytes JMP 75f28bea C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000077ab159d 2 bytes JMP 75f2877e C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000077ab15b5 2 bytes JMP 75e9fd41 C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000077ab15cd 2 bytes JMP 75eab2dc C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000077ab16b2 2 bytes JMP 75f28f4c C:\windows\syswow64\kernel32.dll .text C:\Program Files (x86)\RealVNC\VNC4\WinVNC4.exe[2240] C:\windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000077ab16bd 2 bytes JMP 75f28713 C:\windows\syswow64\kernel32.dll ---- EOF - GMER 2.1 ----