GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-09-06 08:29:11 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000066 ATA_____ rev.06.6 111,79GB Running: xh1iyd9s.exe; Driver: C:\Users\root\AppData\Local\Temp\fxldypod.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\taskhost.exe[2080] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\taskhost.exe[2080] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\taskhost.exe[2080] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\taskhost.exe[2080] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\Dwm.exe[2184] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\Dwm.exe[2184] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\Dwm.exe[2184] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\Dwm.exe[2184] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\Explorer.EXE[2252] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\Explorer.EXE[2252] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\Explorer.EXE[2252] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\Explorer.EXE[2252] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Elantech\ETDCtrl.exe[2532] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDCtrl.exe[2532] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDCtrl.exe[2532] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDCtrl.exe[2532] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2576] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2576] C:\Windows\system32\WS2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2576] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2576] C:\Windows\system32\WS2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2596] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2596] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2596] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2596] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\PeerBlock\peerblock.exe[2624] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\PeerBlock\peerblock.exe[2624] C:\Windows\system32\WS2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\PeerBlock\peerblock.exe[2624] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\PeerBlock\peerblock.exe[2624] C:\Windows\system32\WS2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000071dc1a22 2 bytes [DC, 71] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000071dc1ad0 2 bytes [DC, 71] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000071dc1b08 2 bytes [DC, 71] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000071dc1bba 2 bytes [DC, 71] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000071dc1bda 2 bytes [DC, 71] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000768b1465 2 bytes [8B, 76] .text C:\Windows\SysWOW64\PnkBstrA.exe[2808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768b14bb 2 bytes [8B, 76] .text ... * 2 .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2816] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2816] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2816] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2816] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[2860] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[2860] C:\Windows\system32\WS2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[2860] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[2860] C:\Windows\system32\WS2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Elantech\ETDGesture.exe[2904] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDGesture.exe[2904] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDGesture.exe[2904] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDGesture.exe[2904] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3084] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3084] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3084] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3084] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxEM.exe[3360] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxEM.exe[3360] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxEM.exe[3360] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxEM.exe[3360] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxHK.exe[3392] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxHK.exe[3392] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxHK.exe[3392] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxHK.exe[3392] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxTray.exe[3412] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefdf345c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxTray.exe[3412] C:\Windows\system32\ws2_32.dll!getsockname 000007fefdf39480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxTray.exe[3412] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefdf5e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxTray.exe[3412] C:\Windows\system32\ws2_32.dll!getpeername 000007fefdf5e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000768b1465 2 bytes [8B, 76] .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768b14bb 2 bytes [8B, 76] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [6700] entry point in ".rdata" section 00000000720171e6 ---- Threads - GMER 2.1 ---- Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4072:2832] 000007fefb762bf8 ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Mobile Partner\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006fbc0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006e940000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006a1c0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006ff00000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QueryStrategy.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006efc0000 Library C:\ProgramData\Mobile Partner\OnlineUpdate\QtXml4.dll (*** suspicious ***) @ C:\ProgramData\Mobile Partner\OnlineUpdate\ouc.exe [2776](2014-09-05 18:28:55) 000000006ed40000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885bdf292 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885bdf292 (not active ControlSet) ---- EOF - GMER 2.1 ----