GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-04 18:03:12 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Samsung_SSD_840_EVO_250GB rev.EXT0BB6Q 232,89GB Running: yx7uhs93.exe; Driver: C:\Temp\kgtdqpob.sys ---- User code sections - GMER 2.1 ---- .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075e81401 2 bytes JMP 7553b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075e81419 2 bytes JMP 7553b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075e81431 2 bytes JMP 755b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075e8144a 2 bytes CALL 755148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075e814dd 2 bytes JMP 755b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075e814f5 2 bytes JMP 755b8978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075e8150d 2 bytes JMP 755b8698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075e81525 2 bytes JMP 755b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075e8153d 2 bytes JMP 7552fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075e81555 2 bytes JMP 755368ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075e8156d 2 bytes JMP 755b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075e81585 2 bytes JMP 755b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075e8159d 2 bytes JMP 755b865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075e815b5 2 bytes JMP 7552fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075e815cd 2 bytes JMP 7553b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075e816b2 2 bytes JMP 755b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp[2376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075e816bd 2 bytes JMP 755b85f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[3080] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075518791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075e81401 2 bytes JMP 7553b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075e81419 2 bytes JMP 7553b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075e81431 2 bytes JMP 755b8ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000075e8144a 2 bytes CALL 755148ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000075e814dd 2 bytes JMP 755b87a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000075e814f5 2 bytes JMP 755b8978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000075e8150d 2 bytes JMP 755b8698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075e81525 2 bytes JMP 755b8a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000075e8153d 2 bytes JMP 7552fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075e81555 2 bytes JMP 755368ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000075e8156d 2 bytes JMP 755b8f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075e81585 2 bytes JMP 755b8ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000075e8159d 2 bytes JMP 755b865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000075e815b5 2 bytes JMP 7552fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000075e815cd 2 bytes JMP 7553b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000075e816b2 2 bytes JMP 755b8e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Logitech Gaming Software\Applets\LCDMedia.exe[4552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000075e816bd 2 bytes JMP 755b85f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Process C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\nsu9357.tmpfs (*** suspicious ***) @ C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\nsu9357.tmpfs [1728](2015-03-03 15:32:23) 0000000000820000 Process C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp (*** suspicious ***) @ C:\Users\Computer\AppData\Roaming\03000200-1425400332-0500-0006-000700080009\jnsfE9D6.tmp [2376](2015-03-03 15:32:45) 0000000000dc0000 ---- EOF - GMER 2.1 ----