GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-08-26 14:26:05 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\00000060 SAMSUNG_ rev.FH10 232,88GB Running: 16c9htfl.exe; Driver: C:\Users\Gigi\AppData\Local\Temp\aftcraoc.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification .text C:\Windows\system32\DRIVERS\USBPORT.SYS!DllUnload fffff88003dbcc34 12 bytes {MOV RAX, 0xfffffa8003aaf2a0; JMP RAX} ---- User code sections - GMER 2.1 ---- .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076361401 2 bytes JMP 76ebeb26 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076361419 2 bytes JMP 76ecb513 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076361431 2 bytes JMP 76f48609 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007636144a 2 bytes CALL 76ea1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763614dd 2 bytes JMP 76f47efe C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763614f5 2 bytes JMP 76f480d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007636150d 2 bytes JMP 76f47df4 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076361525 2 bytes JMP 76f481c2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007636153d 2 bytes JMP 76ebf088 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076361555 2 bytes JMP 76ecb885 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007636156d 2 bytes JMP 76f486c1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076361585 2 bytes JMP 76f48222 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007636159d 2 bytes JMP 76f47db8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763615b5 2 bytes JMP 76ebf121 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763615cd 2 bytes JMP 76ecb29f C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763616b2 2 bytes JMP 76f48584 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\system\rads_user_kernel.exe[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763616bd 2 bytes JMP 76f47d4d C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076361401 2 bytes JMP 76ebeb26 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076361419 2 bytes JMP 76ecb513 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076361431 2 bytes JMP 76f48609 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007636144a 2 bytes CALL 76ea1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000763614dd 2 bytes JMP 76f47efe C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000763614f5 2 bytes JMP 76f480d8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007636150d 2 bytes JMP 76f47df4 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076361525 2 bytes JMP 76f481c2 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007636153d 2 bytes JMP 76ebf088 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076361555 2 bytes JMP 76ecb885 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007636156d 2 bytes JMP 76f486c1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076361585 2 bytes JMP 76f48222 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007636159d 2 bytes JMP 76f47db8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000763615b5 2 bytes JMP 76ebf121 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000763615cd 2 bytes JMP 76ecb29f C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000763616b2 2 bytes JMP 76f48584 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_launcher\releases\0.0.0.177\deploy\LoLLauncher.exe[2936] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000763616bd 2 bytes JMP 76f47d4d C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 0000000076361401 2 bytes JMP 76ebeb26 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17 0000000076361419 2 bytes JMP 76ecb513 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17 0000000076361431 2 bytes JMP 76f48609 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42 000000007636144a 2 bytes CALL 76ea1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 00000000763614dd 2 bytes JMP 76f47efe C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 00000000763614f5 2 bytes JMP 76f480d8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 000000007636150d 2 bytes JMP 76f47df4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 0000000076361525 2 bytes JMP 76f481c2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 000000007636153d 2 bytes JMP 76ebf088 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17 0000000076361555 2 bytes JMP 76ecb885 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 000000007636156d 2 bytes JMP 76f486c1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 0000000076361585 2 bytes JMP 76f48222 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 000000007636159d 2 bytes JMP 76f47db8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 00000000763615b5 2 bytes JMP 76ebf121 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 00000000763615cd 2 bytes JMP 76ecb29f C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 00000000763616b2 2 bytes JMP 76f48584 C:\Windows\syswow64\kernel32.dll .text C:\Users\Gigi\Desktop\OTL.scr[2780] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 00000000763616bd 2 bytes JMP 76f47d4d C:\Windows\syswow64\kernel32.dll ---- Kernel IAT/EAT - GMER 2.1 ---- IAT C:\Windows\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortBufferUshort] [fffff88000e65f1c] \SystemRoot\System32\Drivers\sptd.sys [.text] IAT C:\Windows\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortReadPortUchar] [fffff88000e65cc0] \SystemRoot\System32\Drivers\sptd.sys [.text] IAT C:\Windows\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUchar] [fffff88000e6669c] \SystemRoot\System32\Drivers\sptd.sys [.text] IAT C:\Windows\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortUlong] [fffff88000e66a98] \SystemRoot\System32\Drivers\sptd.sys [.text] IAT C:\Windows\system32\DRIVERS\atapi.sys[ataport.SYS!AtaPortWritePortBufferUshort] [fffff88000e668f4] \SystemRoot\System32\Drivers\sptd.sys [.text] ---- Devices - GMER 2.1 ---- Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 fffffa80024902c0 Device \Driver\atapi \Device\Ide\IdePort0 fffffa80024902c0 ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification Device \Driver\atapi \Device\Ide\IdePort1 fffffa80024902c0 ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe suspicious modification Device \FileSystem\Ntfs \Ntfs fffffa8002db62c0 Device \Driver\nvstor \Device\00000060 fffffa80024922c0 Device \Driver\usbehci \Device\USBPDO-1 fffffa8003ac12c0 Device \Driver\NetBT \Device\NetBT_Tcpip_{26401FB6-EBEB-48E2-8565-28C000C1654B} fffffa80039782c0 Device \Driver\nvstor \Device\RaidPort0 fffffa80024922c0 Device \Driver\cdrom \Device\CdRom0 fffffa80034e42c0 Device \Driver\NetBT \Device\NetBT_Tcpip_{27D4E507-2CF1-43EA-9144-8B8BCB5A9440} fffffa80039782c0 Device \Driver\usbohci \Device\USBFDO-0 fffffa8003ab42c0 Device \Driver\usbehci \Device\USBFDO-1 fffffa8003ac12c0 Device \Driver\NetBT \Device\NetBt_Wins_Export fffffa80039782c0 Device \Driver\atapi \Device\ScsiPort0 fffffa80024902c0 Device \Driver\usbohci \Device\USBPDO-0 fffffa8003ab42c0 Device \Driver\atapi \Device\ScsiPort1 fffffa80024902c0 Device \Driver\StarPortLite \Device\StarPortLite fffffa8003a332c0 Device \Driver\nvstor \Device\ScsiPort2 fffffa80024922c0 Device \Driver\StarPortLite \Device\ScsiPort3 fffffa8003a332c0 ---- Trace I/O - GMER 2.1 ---- Trace ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys >>UNKNOWN [0xfffffa80024922c0]<< sptd.sys storport.sys hal.dll nvstor.sys fffffa80024922c0 Trace 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80034b35d0] fffffa80034b35d0 Trace 3 CLASSPNP.SYS[fffff88001b4f43f] -> nt!IofCallDriver -> [0xfffffa80024e0320] fffffa80024e0320 Trace 5 ACPI.sys[fffff880010e9781] -> nt!IofCallDriver -> \Device\00000060[0xfffffa800325f9d0] fffffa800325f9d0 Trace \Driver\nvstor[0xfffffa8002457e70] -> IRP_MJ_CREATE -> 0xfffffa80024922c0 fffffa80024922c0 ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [3492:3724] 000007fef5a09688 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{26401FB6-EBEB-48E2-8565-28C000C1654B}@LeaseObtainedTime 1377519175 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{26401FB6-EBEB-48E2-8565-28C000C1654B}@T1 1377519302 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{26401FB6-EBEB-48E2-8565-28C000C1654B}@T2 1377519398 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{26401FB6-EBEB-48E2-8565-28C000C1654B}@LeaseTerminatesTime 1377519430 ---- EOF - GMER 2.1 ----