GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2016-03-09 14:08:00 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000061 HGST rev.GG2O 465,76GB Running: m6kexhhp.exe; Driver: C:\Users\MODZID~1\AppData\Local\Temp\uwlyypoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[836] C:\Windows\system32\kernel32.dll!SetUnhandledExceptionFilter 0000000076c09040 4 bytes [C3, 00, 00, 00] .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074db1401 2 bytes JMP 7593b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074db1419 2 bytes JMP 7593b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074db1431 2 bytes JMP 759b9011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074db144a 2 bytes CALL 759148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074db14dd 2 bytes JMP 759b890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074db14f5 2 bytes JMP 759b8ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074db150d 2 bytes JMP 759b8800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074db1525 2 bytes JMP 759b8bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074db153d 2 bytes JMP 7592fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074db1555 2 bytes JMP 75936907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074db156d 2 bytes JMP 759b90c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074db1585 2 bytes JMP 759b8c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074db159d 2 bytes JMP 759b87c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074db15b5 2 bytes JMP 7592fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074db15cd 2 bytes JMP 7593b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074db16b2 2 bytes JMP 759b8f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\CodeMeter\Runtime\bin\CodeMeter.exe[3008] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074db16bd 2 bytes JMP 759b8759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074db1401 2 bytes JMP 7593b233 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074db1419 2 bytes JMP 7593b35e C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074db1431 2 bytes JMP 759b9011 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074db144a 2 bytes CALL 759148ad C:\Windows\syswow64\KERNEL32.dll .text ... * 9 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074db14dd 2 bytes JMP 759b890a C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074db14f5 2 bytes JMP 759b8ae0 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074db150d 2 bytes JMP 759b8800 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074db1525 2 bytes JMP 759b8bca C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074db153d 2 bytes JMP 7592fcc0 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074db1555 2 bytes JMP 75936907 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074db156d 2 bytes JMP 759b90c9 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074db1585 2 bytes JMP 759b8c2a C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074db159d 2 bytes JMP 759b87c4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074db15b5 2 bytes JMP 7592fd59 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074db15cd 2 bytes JMP 7593b2f4 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074db16b2 2 bytes JMP 759b8f8c C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe[4940] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074db16bd 2 bytes JMP 759b8759 C:\Windows\syswow64\KERNEL32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074db1401 2 bytes JMP 7593b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074db1419 2 bytes JMP 7593b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074db1431 2 bytes JMP 759b9011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074db144a 2 bytes CALL 759148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074db14dd 2 bytes JMP 759b890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074db14f5 2 bytes JMP 759b8ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074db150d 2 bytes JMP 759b8800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074db1525 2 bytes JMP 759b8bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074db153d 2 bytes JMP 7592fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074db1555 2 bytes JMP 75936907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074db156d 2 bytes JMP 759b90c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074db1585 2 bytes JMP 759b8c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074db159d 2 bytes JMP 759b87c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074db15b5 2 bytes JMP 7592fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074db15cd 2 bytes JMP 7593b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074db16b2 2 bytes JMP 759b8f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[5000] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074db16bd 2 bytes JMP 759b8759 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library c:\users\modzid~1\appdata\local\temp\7zs13dd\hpslpsvc64.dll (*** suspicious ***) @ C:\Windows\system32\svchost.exe [3464] (HP Network Devices Support/Hewlett-Packard Co.)(2015-06-23 07:46:20) 0000000180000000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\54271e41d6f9 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\54271e41d7ef Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\54271e41d6f9 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\54271e41d7ef (not active ControlSet) ---- Files - GMER 2.1 ---- File C:\Users\m³odzidlaJezusa\AppData\Local\Mozilla\Firefox\Profiles\1ik63ksb.default\cache2\entries\611131798F09DC27E32065B8AC1A38D7C5F1268B (size mismatch) 86016/984 bytes executable File C:\Users\m³odzidlaJezusa\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\F90F18257CBB4D84216AC1E1F3BB2C76 (size mismatch) 615936/550 bytes executable ---- EOF - GMER 2.1 ----