GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-09-06 13:40:57 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000065 ATA_____ rev.06.6 111,79GB Running: xh1iyd9s.exe; Driver: C:\Users\root\AppData\Local\Temp\fxldypod.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\system32\taskhost.exe[1724] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\taskhost.exe[1724] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\taskhost.exe[1724] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\taskhost.exe[1724] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\Dwm.exe[2084] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\Dwm.exe[2084] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\Dwm.exe[2084] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\Dwm.exe[2084] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\Explorer.EXE[2132] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\Explorer.EXE[2132] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\Explorer.EXE[2132] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\Explorer.EXE[2132] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072731a22 2 bytes [73, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072731ad0 2 bytes [73, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072731b08 2 bytes [73, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072731bba 2 bytes [73, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072731bda 2 bytes [73, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076881465 2 bytes [88, 76] .text C:\Windows\SysWOW64\PnkBstrA.exe[2324] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768814bb 2 bytes [88, 76] .text ... * 2 .text C:\Program Files\Elantech\ETDCtrl.exe[2624] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDCtrl.exe[2624] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDCtrl.exe[2624] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDCtrl.exe[2624] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2656] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2656] C:\Windows\system32\WS2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2656] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Dell\DW WLAN Card\WLTRAY.EXE[2656] C:\Windows\system32\WS2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2664] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2664] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2664] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Microsoft Security Client\msseces.exe[2664] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\PeerBlock\peerblock.exe[2740] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\PeerBlock\peerblock.exe[2740] C:\Windows\system32\WS2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\PeerBlock\peerblock.exe[2740] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\PeerBlock\peerblock.exe[2740] C:\Windows\system32\WS2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxEM.exe[580] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxEM.exe[580] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxEM.exe[580] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxEM.exe[580] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxHK.exe[2128] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxHK.exe[2128] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxHK.exe[2128] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxHK.exe[2128] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2428] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2428] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2428] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDCtrlHelper.exe[2428] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Windows\system32\igfxTray.exe[2320] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Windows\system32\igfxTray.exe[2320] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Windows\system32\igfxTray.exe[2320] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Windows\system32\igfxTray.exe[2320] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\Elantech\ETDGesture.exe[2112] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\Elantech\ETDGesture.exe[2112] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\Elantech\ETDGesture.exe[2112] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\Elantech\ETDGesture.exe[2112] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[3204] C:\Windows\system32\WS2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[3204] C:\Windows\system32\WS2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[3204] C:\Windows\system32\WS2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files\HWiNFO64\HWiNFO64.EXE[3204] C:\Windows\system32\WS2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3392] C:\Windows\system32\ws2_32.dll!connect + 1 000007fefee445c1 5 bytes {JMP QWORD [RIP-0x7fef458e]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3392] C:\Windows\system32\ws2_32.dll!getsockname 000007fefee49480 6 bytes {JMP QWORD [RIP-0x7fed9416]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3392] C:\Windows\system32\ws2_32.dll!WSAConnect 000007fefee6e0f0 6 bytes {JMP QWORD [RIP-0x7fefe0be]} .text C:\Program Files (x86)\ATI Technologies\HydraVision\HydraDM64.exe[3392] C:\Windows\system32\ws2_32.dll!getpeername 000007fefee6e450 6 bytes {JMP QWORD [RIP-0x7fefe3ae]} .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076881465 2 bytes [88, 76] .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4180] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768814bb 2 bytes [88, 76] .text ... * 2 .text D:\tool\totalcmd\TOTALCMD.EXE[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076881465 2 bytes [88, 76] .text D:\tool\totalcmd\TOTALCMD.EXE[3232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000768814bb 2 bytes [88, 76] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [3232] entry point in ".rdata" section 00000000643871e6 .text E:\Clean\OTL.exe[4132] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69 0000000076881465 2 bytes [88, 76] .text E:\Clean\OTL.exe[4132] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155 00000000768814bb 2 bytes [88, 76] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c01885bdf292 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c01885bdf292 (not active ControlSet) ---- EOF - GMER 2.1 ----