GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-09-09 17:55:52 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 Hitachi_HDS721050CLA362 rev.JP2OA25C 465,76GB Running: hduq03ef.exe; Driver: C:\Users\Patryk\AppData\Local\Temp\pgddqpoc.sys ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRollbackEnlistment + 142D 82E56A15 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82E90212 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x91A0B000, 0x2BFBF0, 0xE8000020] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtCreateFile + 6 778F560E 4 Bytes [28, B0, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtCreateFile + B 778F5613 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtMapViewOfSection + 6 778F5C6E 4 Bytes [28, B3, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtMapViewOfSection + B 778F5C73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenFile + 6 778F5D1E 4 Bytes [68, B0, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenFile + B 778F5D23 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenProcess + 6 778F5DCE 4 Bytes [A8, B1, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenProcess + B 778F5DD3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenProcessToken + B 778F5DE3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenProcessTokenEx + 6 778F5DEE 4 Bytes [A8, B2, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenProcessTokenEx + B 778F5DF3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenThread + 6 778F5E4E 4 Bytes [68, B1, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenThread + B 778F5E53 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenThreadToken + 6 778F5E5E 4 Bytes [68, B2, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenThreadToken + B 778F5E63 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtOpenThreadTokenEx + B 778F5E73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtQueryAttributesFile + 6 778F5F7E 4 Bytes [A8, B0, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtQueryAttributesFile + B 778F5F83 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtQueryFullAttributesFile + B 778F6033 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtSetInformationFile + 6 778F667E 4 Bytes [28, B1, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtSetInformationFile + B 778F6683 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtSetInformationThread + 6 778F66DE 4 Bytes [28, B2, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtSetInformationThread + B 778F66E3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtTerminateProcess 778F6908 5 Bytes JMP 013AEAD6 C:\Program Files\Google\Chrome\Application\chrome.exe .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtUnmapViewOfSection + 6 778F69FE 4 Bytes [68, B3, 42, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[1912] ntdll.dll!NtUnmapViewOfSection + B 778F6A03 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateFile + 6 778F560E 4 Bytes [28, 90, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtCreateFile + B 778F5613 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtMapViewOfSection + 6 778F5C6E 4 Bytes [28, 93, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtMapViewOfSection + B 778F5C73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenFile + 6 778F5D1E 4 Bytes [68, 90, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenFile + B 778F5D23 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenProcess + 6 778F5DCE 4 Bytes [A8, 91, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenProcess + B 778F5DD3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenProcessToken + B 778F5DE3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenProcessTokenEx + 6 778F5DEE 4 Bytes [A8, 92, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenProcessTokenEx + B 778F5DF3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenThread + 6 778F5E4E 4 Bytes [68, 91, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenThread + B 778F5E53 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenThreadToken + 6 778F5E5E 4 Bytes [68, 92, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenThreadToken + B 778F5E63 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtOpenThreadTokenEx + B 778F5E73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryAttributesFile + 6 778F5F7E 4 Bytes [A8, 90, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryAttributesFile + B 778F5F83 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtQueryFullAttributesFile + B 778F6033 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationFile + 6 778F667E 4 Bytes [28, 91, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationFile + B 778F6683 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationThread + 6 778F66DE 4 Bytes [28, 92, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtSetInformationThread + B 778F66E3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtTerminateProcess 778F6908 5 Bytes JMP 013AEAD6 C:\Program Files\Google\Chrome\Application\chrome.exe .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtUnmapViewOfSection + 6 778F69FE 4 Bytes [68, 93, 99, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[4084] ntdll.dll!NtUnmapViewOfSection + B 778F6A03 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtCreateFile + 6 778F560E 4 Bytes [28, 1C, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtCreateFile + B 778F5613 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtMapViewOfSection + 6 778F5C6E 4 Bytes [28, 1F, 73, 00] {SUB [EDI], BL; JAE 0x4} .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtMapViewOfSection + B 778F5C73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenFile + 6 778F5D1E 4 Bytes [68, 1C, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenFile + B 778F5D23 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenProcess + 6 778F5DCE 4 Bytes [A8, 1D, 73, 00] {TEST AL, 0x1d; JAE 0x4} .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenProcess + B 778F5DD3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenProcessToken + B 778F5DE3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenProcessTokenEx + 6 778F5DEE 4 Bytes [A8, 1E, 73, 00] {TEST AL, 0x1e; JAE 0x4} .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenProcessTokenEx + B 778F5DF3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenThread + 6 778F5E4E 4 Bytes [68, 1D, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenThread + B 778F5E53 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenThreadToken + 6 778F5E5E 4 Bytes [68, 1E, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenThreadToken + B 778F5E63 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtOpenThreadTokenEx + B 778F5E73 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtQueryAttributesFile + 6 778F5F7E 4 Bytes [A8, 1C, 73, 00] {TEST AL, 0x1c; JAE 0x4} .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtQueryAttributesFile + B 778F5F83 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtQueryFullAttributesFile + B 778F6033 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtSetInformationFile + 6 778F667E 4 Bytes [28, 1D, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtSetInformationFile + B 778F6683 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtSetInformationThread + 6 778F66DE 4 Bytes [28, 1E, 73, 00] {SUB [ESI], BL; JAE 0x4} .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtSetInformationThread + B 778F66E3 1 Byte [E2] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtTerminateProcess 778F6908 5 Bytes JMP 013AEAD6 C:\Program Files\Google\Chrome\Application\chrome.exe .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtUnmapViewOfSection + 6 778F69FE 4 Bytes [68, 1F, 73, 00] .text C:\Program Files\Google\Chrome\Application\chrome.exe[5644] ntdll.dll!NtUnmapViewOfSection + B 778F6A03 1 Byte [E2] ---- Registry - GMER 2.1 ---- Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{11F55F9E-45D5-11E2-B520-806E6F6E6963} 6353282696 Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@E:\Gry Cracki\Zootycoon2\Zoo Tycoon 2 \xae Ultimate Collection with save+Extras\Zoo Tycoon 2\Setup.Exe 1 Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@E:\Gry Cracki\Zootycoon2\Zoo Tycoon 2 \xae Ultimate Collection with save+Extras\Zoo Tycoon 2 - Dino Danger Pack\DDP_enu-setup.exe 1 Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@E:\Gry Cracki\Zootycoon2\Zoo Tycoon 2 \xae Ultimate Collection with save+Extras\Zoo Tycoon 2 - Marine Mania\setup.exe 1 Reg HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@E:\Gry Cracki\Zootycoon2\Zoo Tycoon 2 \xae Ultimate Collection with save+Extras\DAEMON Tools Lite 4.11.2\daemon-4112-lite.exe 1 ---- EOF - GMER 2.1 ----