GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-11-18 19:49:47 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 WDC_WD1600BEVS-60RST0 rev.04.01G04 149,05GB Running: jhnmqgsg.exe; Driver: C:\Users\User\AppData\Local\Temp\kxldapob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075e18781 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 75e3b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 75e3b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 75eb8fd1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 75e1489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 75eb88c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 75eb8aa0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 75eb87ba C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 75eb8b8a C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 75e2fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000756e1555 2 bytes JMP 75e368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 75eb9089 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 75eb8bea C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 75eb877e C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 75e2fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 75e3b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 75eb8f4c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1944] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 75eb8713 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2908] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075bb2ab1 5 bytes JMP 00000001013ff4f2 .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000756e1401 2 bytes JMP 75e3b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000756e1419 2 bytes JMP 75e3b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000756e1431 2 bytes JMP 75eb8fd1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000756e144a 2 bytes CALL 75e1489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000756e14dd 2 bytes JMP 75eb88c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000756e14f5 2 bytes JMP 75eb8aa0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000756e150d 2 bytes JMP 75eb87ba C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000756e1525 2 bytes JMP 75eb8b8a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000756e153d 2 bytes JMP 75e2fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000756e1555 2 bytes JMP 75e368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000756e156d 2 bytes JMP 75eb9089 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000756e1585 2 bytes JMP 75eb8bea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000756e159d 2 bytes JMP 75eb877e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000756e15b5 2 bytes JMP 75e2fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000756e15cd 2 bytes JMP 75e3b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000756e16b2 2 bytes JMP 75eb8f4c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Brother\ControlCenter3\brccMCtl.exe[980] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000756e16bd 2 bytes JMP 75eb8713 C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [1728:3468] 000007feee619688 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2732:4128] 000007fefafa2ae8 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001e37b67de6 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001e37b67de6@bccfcceac606 0x47 0x2B 0xF3 0x28 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001e37b67de6@e4f8ef1601ba 0xB9 0xE0 0x5F 0xD7 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001e37b67de6 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001e37b67de6@bccfcceac606 0x47 0x2B 0xF3 0x28 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001e37b67de6@e4f8ef1601ba 0xB9 0xE0 0x5F 0xD7 ... ---- EOF - GMER 2.1 ----