GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-04-02 17:23:29 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000069 WDC_WD32 rev.01.0 298,09GB Running: gmer.exe; Driver: C:\Users\acer\AppData\Local\Temp\pgldrpob.sys ---- User code sections - GMER 2.2 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077521401 2 bytes JMP 7744b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077521419 2 bytes JMP 7744b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077521431 2 bytes JMP 774c9011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007752144a 2 bytes CALL 774248ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775214dd 2 bytes JMP 774c890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775214f5 2 bytes JMP 774c8ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007752150d 2 bytes JMP 774c8800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077521525 2 bytes JMP 774c8bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007752153d 2 bytes JMP 7743fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077521555 2 bytes JMP 77446907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007752156d 2 bytes JMP 774c90c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077521585 2 bytes JMP 774c8c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007752159d 2 bytes JMP 774c87c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775215b5 2 bytes JMP 7743fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775215cd 2 bytes JMP 7744b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775216b2 2 bytes JMP 774c8f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2576] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775216bd 2 bytes JMP 774c8759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077521401 2 bytes JMP 7744b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077521419 2 bytes JMP 7744b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077521431 2 bytes JMP 774c9011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007752144a 2 bytes CALL 774248ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775214dd 2 bytes JMP 774c890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775214f5 2 bytes JMP 774c8ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007752150d 2 bytes JMP 774c8800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077521525 2 bytes JMP 774c8bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007752153d 2 bytes JMP 7743fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077521555 2 bytes JMP 77446907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007752156d 2 bytes JMP 774c90c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077521585 2 bytes JMP 774c8c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007752159d 2 bytes JMP 774c87c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775215b5 2 bytes JMP 7743fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775215cd 2 bytes JMP 7744b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775216b2 2 bytes JMP 774c8f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Launch Manager\LManager.exe[732] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775216bd 2 bytes JMP 774c8759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077521401 2 bytes JMP 7744b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077521419 2 bytes JMP 7744b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077521431 2 bytes JMP 774c9011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007752144a 2 bytes CALL 774248ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000775214dd 2 bytes JMP 774c890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000775214f5 2 bytes JMP 774c8ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007752150d 2 bytes JMP 774c8800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077521525 2 bytes JMP 774c8bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007752153d 2 bytes JMP 7743fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077521555 2 bytes JMP 77446907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007752156d 2 bytes JMP 774c90c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077521585 2 bytes JMP 774c8c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007752159d 2 bytes JMP 774c87c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000775215b5 2 bytes JMP 7743fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000775215cd 2 bytes JMP 7744b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000775216b2 2 bytes JMP 774c8f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[4964] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000775216bd 2 bytes JMP 774c8759 C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.2 ---- Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3912:2792] 000007fef5655024 Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3912:3624] 000007fef4524c8c Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3912:2796] 000007fef5655024 Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3912:3292] 000007fefb6ecffc Thread c:\Program Files\Microsoft Mouse and Keyboard Center\ipoint.exe [3912:1804] 000007fef5655024 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x63 0xB4 0x48 0x2E ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x63 0xB4 0x48 0x2E ... Reg HKLM\SYSTEM\ControlSet004\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet004\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet004\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet004\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x63 0xB4 0x48 0x2E ... ---- EOF - GMER 2.2 ----