GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-22 19:43:47 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006c PLEXTOR_ rev.1.05 119,24GB Running: ssqvq7v0.exe; Driver: C:\Users\Daniel\AppData\Local\Temp\uwdirpod.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000072cf17fa 2 bytes CALL 75e811a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000072cf1860 2 bytes CALL 75e811a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000072cf1942 2 bytes JMP 76467089 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000072cf194d 2 bytes JMP 7646cba6 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076291401 2 bytes JMP 75eab21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076291419 2 bytes JMP 75eab346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076291431 2 bytes JMP 75f28fd1 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007629144a 2 bytes CALL 75e8489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000762914dd 2 bytes JMP 75f288c4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000762914f5 2 bytes JMP 75f28aa0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007629150d 2 bytes JMP 75f287ba C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076291525 2 bytes JMP 75f28b8a C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007629153d 2 bytes JMP 75e9fca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076291555 2 bytes JMP 75ea68ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007629156d 2 bytes JMP 75f29089 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076291585 2 bytes JMP 75f28bea C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007629159d 2 bytes JMP 75f2877e C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000762915b5 2 bytes JMP 75e9fd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000762915cd 2 bytes JMP 75eab2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000762916b2 2 bytes JMP 75f28f4c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[2556] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000762916bd 2 bytes JMP 75f28713 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076291401 2 bytes JMP 75eab21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076291419 2 bytes JMP 75eab346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076291431 2 bytes JMP 75f28fd1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007629144a 2 bytes CALL 75e8489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000762914dd 2 bytes JMP 75f288c4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000762914f5 2 bytes JMP 75f28aa0 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007629150d 2 bytes JMP 75f287ba C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076291525 2 bytes JMP 75f28b8a C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007629153d 2 bytes JMP 75e9fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076291555 2 bytes JMP 75ea68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007629156d 2 bytes JMP 75f29089 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076291585 2 bytes JMP 75f28bea C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007629159d 2 bytes JMP 75f2877e C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000762915b5 2 bytes JMP 75e9fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000762915cd 2 bytes JMP 75eab2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000762916b2 2 bytes JMP 75f28f4c C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[2764] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000762916bd 2 bytes JMP 75f28713 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076291401 2 bytes JMP 75eab21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076291419 2 bytes JMP 75eab346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076291431 2 bytes JMP 75f28fd1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007629144a 2 bytes CALL 75e8489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000762914dd 2 bytes JMP 75f288c4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000762914f5 2 bytes JMP 75f28aa0 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007629150d 2 bytes JMP 75f287ba C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076291525 2 bytes JMP 75f28b8a C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007629153d 2 bytes JMP 75e9fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076291555 2 bytes JMP 75ea68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007629156d 2 bytes JMP 75f29089 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076291585 2 bytes JMP 75f28bea C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007629159d 2 bytes JMP 75f2877e C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000762915b5 2 bytes JMP 75e9fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000762915cd 2 bytes JMP 75eab2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000762916b2 2 bytes JMP 75f28f4c C:\Windows\syswow64\kernel32.dll .text C:\Users\Daniel\AppData\Local\Akamai\netsession_win.exe[3248] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000762916bd 2 bytes JMP 75f28713 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076291401 2 bytes JMP 75eab21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076291419 2 bytes JMP 75eab346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076291431 2 bytes JMP 75f28fd1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007629144a 2 bytes CALL 75e8489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000762914dd 2 bytes JMP 75f288c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000762914f5 2 bytes JMP 75f28aa0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007629150d 2 bytes JMP 75f287ba C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076291525 2 bytes JMP 75f28b8a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007629153d 2 bytes JMP 75e9fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076291555 2 bytes JMP 75ea68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007629156d 2 bytes JMP 75f29089 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076291585 2 bytes JMP 75f28bea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007629159d 2 bytes JMP 75f2877e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000762915b5 2 bytes JMP 75e9fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000762915cd 2 bytes JMP 75eab2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000762916b2 2 bytes JMP 75f28f4c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NETGEAR\WNDA3100v2\WNDA3100v2.exe[3280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000762916bd 2 bytes JMP 75f28713 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076291401 2 bytes JMP 75eab21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076291419 2 bytes JMP 75eab346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076291431 2 bytes JMP 75f28fd1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007629144a 2 bytes CALL 75e8489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000762914dd 2 bytes JMP 75f288c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000762914f5 2 bytes JMP 75f28aa0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007629150d 2 bytes JMP 75f287ba C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076291525 2 bytes JMP 75f28b8a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007629153d 2 bytes JMP 75e9fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076291555 2 bytes JMP 75ea68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007629156d 2 bytes JMP 75f29089 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076291585 2 bytes JMP 75f28bea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007629159d 2 bytes JMP 75f2877e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000762915b5 2 bytes JMP 75e9fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000762915cd 2 bytes JMP 75eab2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000762916b2 2 bytes JMP 75f28f4c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[3600] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000762916bd 2 bytes JMP 75f28713 C:\Windows\syswow64\kernel32.dll .text C:\Windows\system32\SearchIndexer.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000077210128 .text C:\Windows\system32\SearchIndexer.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000077210018 .text C:\Windows\system32\SearchIndexer.exe[4564] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000000772101b0 .text C:\Windows\system32\WLANExt.exe[4456] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000077210128 .text C:\Windows\system32\WLANExt.exe[4456] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000077210018 .text C:\Windows\system32\WLANExt.exe[4456] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000000772101b0 .text C:\Windows\system32\WLANExt.exe[4456] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076e5db10 1 byte JMP 00000000772100a0 .text C:\Windows\system32\WLANExt.exe[4456] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 0000000076e5db12 3 bytes {JMP 0x3b2590} .text C:\Windows\system32\conhost.exe[4092] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000077210128 .text C:\Windows\system32\conhost.exe[4092] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000077210018 .text C:\Windows\system32\conhost.exe[4092] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000000772101b0 .text C:\Windows\system32\conhost.exe[4092] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076e5db10 1 byte JMP 00000000772100a0 .text C:\Windows\system32\conhost.exe[4092] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 0000000076e5db12 3 bytes {JMP 0x3b2590} .text C:\Windows\system32\svchost.exe[5184] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000177050128 .text C:\Windows\system32\svchost.exe[5184] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000177050018 .text C:\Windows\system32\svchost.exe[5184] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000001770501b0 .text C:\Windows\system32\svchost.exe[5184] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076e5db10 1 byte JMP 00000000770500a0 .text C:\Windows\system32\svchost.exe[5184] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 0000000076e5db12 3 bytes {JMP 0x1f2590} .text C:\Windows\System32\svchost.exe[5440] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000177050128 .text C:\Windows\System32\svchost.exe[5440] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000177050018 .text C:\Windows\System32\svchost.exe[5440] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000001770501b0 .text C:\Windows\System32\svchost.exe[5440] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076e5db10 1 byte JMP 00000000770500a0 .text C:\Windows\System32\svchost.exe[5440] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 0000000076e5db12 3 bytes {JMP 0x1f2590} .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5380] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007725fc90 5 bytes JMP 000000016ad019d0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5380] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 000000007725fe54 5 bytes JMP 000000016ad015f0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5380] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 00000000772600a8 5 bytes JMP 000000016ad01bb0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5380] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 0000000075e93bab 5 bytes JMP 000000016ad01760 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5936] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007725fc90 5 bytes JMP 000000016ad019d0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5936] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 000000007725fe54 5 bytes JMP 000000016ad015f0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5936] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 00000000772600a8 5 bytes JMP 000000016ad01bb0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[5936] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 0000000075e93bab 5 bytes JMP 000000016ad01760 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5788] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007725fc90 5 bytes JMP 000000016ad019d0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5788] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 000000007725fe54 5 bytes JMP 000000016ad015f0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5788] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 00000000772600a8 5 bytes JMP 000000016ad01bb0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5788] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000075e93bab 5 bytes JMP 000000016ad01760 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2808] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007725fc90 5 bytes JMP 000000016ad019d0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2808] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 000000007725fe54 5 bytes JMP 000000016ad015f0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2808] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 00000000772600a8 5 bytes JMP 000000016ad01bb0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe[2808] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000075e93bab 5 bytes JMP 000000016ad01760 .text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3292] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 000000007725fc90 5 bytes JMP 000000016ad019d0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3292] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 000000007725fe54 5 bytes JMP 000000016ad015f0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3292] C:\Windows\SysWOW64\ntdll.dll!NtResumeThread 00000000772600a8 5 bytes JMP 000000016ad01bb0 .text C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe[3292] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000075e93bab 5 bytes JMP 000000016ad01760 .text C:\Windows\system32\svchost.exe[2912] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 00000000770adc30 5 bytes JMP 0000000177050128 .text C:\Windows\system32\svchost.exe[2912] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 00000000770add50 5 bytes JMP 0000000177050018 .text C:\Windows\system32\svchost.exe[2912] C:\Windows\SYSTEM32\ntdll.dll!NtResumeThread 00000000770aded0 5 bytes JMP 00000001770501b0 .text C:\Windows\system32\svchost.exe[2912] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 0000000076e5db10 1 byte JMP 00000000770500a0 .text C:\Windows\system32\svchost.exe[2912] C:\Windows\system32\kernel32.dll!CreateProcessInternalW + 2 0000000076e5db12 3 bytes {JMP 0x1f2590} ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}\Connection@Name isatap.{A1592465-B720-469A-ABCC-D4DF4FCAF40C} Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}?\Device\{60DAEF69-410C-4977-B8E1-9085605D6439}?\Device\{A121D3A1-9658-4820-BB74-29F360753F58}? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}"?"{60DAEF69-410C-4977-B8E1-9085605D6439}"?"{A121D3A1-9658-4820-BB74-29F360753F58}"? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}?\Device\TCPIP6TUNNEL_{60DAEF69-410C-4977-B8E1-9085605D6439}?\Device\TCPIP6TUNNEL_{A121D3A1-9658-4820-BB74-29F360753F58}? Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}@InterfaceName isatap.{A1592465-B720-469A-ABCC-D4DF4FCAF40C} Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D9CD59F3-F43B-4FEA-8708-ECE6D47849A7}@ReusableType 0 ---- EOF - GMER 2.1 ----