GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-09-04 21:05:12 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\00000061 WDC_WD10 rev.80.0 931,51GB Running: bqz4ge1o.exe; Driver: C:\Users\Bowflan\AppData\Local\Temp\pwdiyfob.sys ---- User code sections - GMER 2.1 ---- .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExW + 17 0000000075361401 2 bytes JMP 7664eb26 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!EnumProcessModules + 17 0000000075361419 2 bytes JMP 7665b513 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 17 0000000075361431 2 bytes JMP 766d8609 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 42 000000007536144a 2 bytes CALL 76631dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!EnumDeviceDrivers + 17 00000000753614dd 2 bytes JMP 766d7efe C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameA + 17 00000000753614f5 2 bytes JMP 766d80d8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSetEx + 17 000000007536150d 2 bytes JMP 766d7df4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetDeviceDriverBaseNameW + 17 0000000075361525 2 bytes JMP 766d81c2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameW + 17 000000007536153d 2 bytes JMP 7664f088 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!EnumProcesses + 17 0000000075361555 2 bytes JMP 7665b885 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetProcessMemoryInfo + 17 000000007536156d 2 bytes JMP 766d86c1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetPerformanceInfo + 17 0000000075361585 2 bytes JMP 766d8222 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!QueryWorkingSet + 17 000000007536159d 2 bytes JMP 766d7db8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleBaseNameA + 17 00000000753615b5 2 bytes JMP 7664f121 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetModuleFileNameExA + 17 00000000753615cd 2 bytes JMP 7665b29f C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 20 00000000753616b2 2 bytes JMP 766d8584 C:\Windows\syswow64\kernel32.dll .text C:\Users\Bowflan\Downloads\OTL.exe[2768] C:\Windows\syswow64\PSAPI.dll!GetProcessImageFileNameW + 31 00000000753616bd 2 bytes JMP 766d7d4d C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [880:312] 000007fefb5cf440 Thread C:\Windows\System32\svchost.exe [880:332] 000007fefb506204 Thread C:\Windows\System32\svchost.exe [880:1068] 000007fefa6f2070 Thread C:\Windows\System32\svchost.exe [880:1080] 000007fefa5f5440 Thread C:\Windows\System32\svchost.exe [880:2496] 000007fef86f6b8c Thread C:\Windows\System32\svchost.exe [880:2500] 000007fef86f1d88 Thread C:\Windows\System32\svchost.exe [880:3300] 000007fef8c75fd0 Thread C:\Windows\System32\svchost.exe [880:3372] 000007fefd16c7d4 Thread C:\Windows\System32\svchost.exe [928:1292] 000007feefd13e98 Thread C:\Windows\System32\svchost.exe [928:3740] 000007feefde8a4c Thread C:\Windows\system32\svchost.exe [1072:1752] 000007fef8aef978 Thread C:\Windows\system32\svchost.exe [1072:2616] 000007fef69dfd00 Thread C:\Windows\system32\svchost.exe [1072:1436] 000007fef8975124 Thread C:\Windows\system32\svchost.exe [1628:1288] 000007fef80f8470 Thread C:\Windows\system32\svchost.exe [1628:764] 000007fef8102418 Thread C:\Windows\system32\svchost.exe [1628:2756] 000007fef810976c Thread C:\Windows\system32\svchost.exe [1628:3884] 000007fef642f130 Thread C:\Windows\system32\svchost.exe [1628:4028] 000007fef6424734 Thread C:\Windows\system32\svchost.exe [1628:2424] 000007fef6424734 Thread C:\Windows\system32\svchost.exe [1628:1764] 000007fef4cb5b84 Thread C:\Windows\System32\svchost.exe [2992:2288] 000007fef6469688 Thread C:\Windows\System32\svchost.exe [3480:3228] 000007fef69dfd00 Thread C:\Windows\System32\svchost.exe [3480:2816] 000007fef8979874 Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3180:3248] 000007feed7eb328 Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3180:3124] 000007feed7f08e4 Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [3180:3760] 000007feed7f08e4 ---- EOF - GMER 2.1 ----