GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-02-03 12:10:29 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB Running: z84dhopw.exe; Driver: C:\Users\Konrad\AppData\Local\Temp\kwtirkoc.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 448 fffff80003e07000 52 bytes [FF, FF, FF, FF, FF, FF, FF, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 502 fffff80003e07036 27 bytes [FF, FF, FF, FF, FF, FF, FF, ...] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000074bc8791 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000074fb1401 2 bytes JMP 74beb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000074fb1419 2 bytes JMP 74beb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000074fb1431 2 bytes JMP 74c68ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 0000000074fb144a 2 bytes CALL 74bc48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 0000000074fb14dd 2 bytes JMP 74c687a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 0000000074fb14f5 2 bytes JMP 74c68978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 0000000074fb150d 2 bytes JMP 74c68698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000074fb1525 2 bytes JMP 74c68a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 0000000074fb153d 2 bytes JMP 74bdfca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000074fb1555 2 bytes JMP 74be68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 0000000074fb156d 2 bytes JMP 74c68f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000074fb1585 2 bytes JMP 74c68ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 0000000074fb159d 2 bytes JMP 74c6865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 0000000074fb15b5 2 bytes JMP 74bdfd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 0000000074fb15cd 2 bytes JMP 74beb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 0000000074fb16b2 2 bytes JMP 74c68e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET Endpoint Antivirus\x86\ekrn.exe[2128] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 0000000074fb16bd 2 bytes JMP 74c685f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074fb1401 2 bytes JMP 74beb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074fb1419 2 bytes JMP 74beb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074fb1431 2 bytes JMP 74c68ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074fb144a 2 bytes CALL 74bc48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074fb14dd 2 bytes JMP 74c687a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074fb14f5 2 bytes JMP 74c68978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074fb150d 2 bytes JMP 74c68698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074fb1525 2 bytes JMP 74c68a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074fb153d 2 bytes JMP 74bdfca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074fb1555 2 bytes JMP 74be68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074fb156d 2 bytes JMP 74c68f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074fb1585 2 bytes JMP 74c68ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074fb159d 2 bytes JMP 74c6865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074fb15b5 2 bytes JMP 74bdfd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074fb15cd 2 bytes JMP 74beb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074fb16b2 2 bytes JMP 74c68e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4336] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074fb16bd 2 bytes JMP 74c685f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!GetMenu + 412 00000000754f51dd 7 bytes JMP 000000011003ac50 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!PeekMessageA + 407 00000000754f610b 7 bytes JMP 000000011003b000 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!CreateDialogIndirectParamW + 131 00000000754fc6c1 7 bytes JMP 000000011003abc0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectA + 199 000000007553fc98 7 bytes JMP 000000011003af50 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!MessageBoxIndirectW + 52 000000007553fcd1 7 bytes JMP 000000011003adf0 .text C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe[5032] C:\Windows\syswow64\USER32.dll!MessageBoxExA + 31 000000007553fcf5 7 bytes JMP 000000011003af00 ---- Threads - GMER 2.1 ---- Thread C:\Windows\SysWOW64\ntdll.dll [2220:2224] 0000000000034c9e ---- Processes - GMER 2.1 ---- Process C:\ProgramData\DatacardService\HWDeviceService64.exe (*** suspicious ***) @ C:\ProgramData\DatacardService\HWDeviceService64.exe [2752](2010-11-16 13:38:16) 000000013f2e0000 Process C:\ProgramData\DatacardService\DCSHelper.exe (*** suspicious ***) @ C:\ProgramData\DatacardService\DCSHelper.exe [2852] (DataCardMonitor MFC Application/Huawei Technologies Co., Ltd.)(2010-11-16 13:37:30) 0000000000400000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac72899d55c0 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 15095 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac72899d55c0 (not active ControlSet) ---- EOF - GMER 2.1 ----