GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-06 21:31:33 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Samsung_ rev.EXT0 232,89GB Running: 009gpb0c.exe; Driver: C:\Users\Julia\AppData\Local\Temp\fwddykob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1740] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2852] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [2852] entry point in ".rdata" section 00000000604c71e6 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd0d2db0 5 bytes JMP 000007fffd080180 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd0d37d0 7 bytes JMP 000007fffd0800d8 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd0d8ef0 6 bytes JMP 000007fffd080148 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd0eaf60 5 bytes JMP 000007fffd080110 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefeaf89f0 8 bytes JMP 000007fffd0801f0 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefeafbe50 8 bytes JMP 000007fffd0801b8 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef70cdc88 5 bytes JMP 000007fff6ff00d8 .text C:\Windows\system32\Dwm.exe[3032] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef70cde10 5 bytes JMP 000007fff6ff0110 .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe[3340] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[3584] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Users\Julia\AppData\Local\Akamai\netsession_win.exe[3780] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Samsung\Easy Settings\EasySpeedUpManager.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!RegSetValueExW 00000000770da400 7 bytes JMP 000000016fff0260 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!RegQueryValueExW 00000000770e3f20 5 bytes JMP 000000016fff01b8 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!RegDeleteValueW 00000000770fffb0 5 bytes JMP 000000016fff01f0 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007710f2e0 5 bytes JMP 000000016fff0148 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077139a30 7 bytes JMP 000000016fff00d8 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000771494c0 5 bytes JMP 000000016fff0180 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077149630 5 bytes JMP 000000016fff0110 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000771687e0 7 bytes JMP 000000016fff0228 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefd0d2db0 5 bytes JMP 000007fffd050180 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefd0d37d0 7 bytes JMP 000007fffd0500d8 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefd0d8ef0 6 bytes JMP 000007fffd050148 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefd0eaf60 5 bytes JMP 000007fffd050110 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007fefeaf89f0 8 bytes JMP 000007fffd0501f0 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007fefeafbe50 8 bytes JMP 000007fffd0501b8 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefeba7490 11 bytes JMP 000007fffd050228 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefebbbf00 3 bytes JMP 000007fffd050260 .text C:\Program Files\Common Files\Autodesk Shared\WSCommCntr4\lib\WSCommCntr4.exe[3620] C:\Windows\system32\ole32.dll!CoSetProxyBlanket + 4 000007fefebbbf04 3 bytes [FE, CC, CC] .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075511401 2 bytes JMP 76abb21b C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075511419 2 bytes JMP 76abb346 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075511431 2 bytes JMP 76b38ea9 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007551144a 2 bytes CALL 76a948ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000755114dd 2 bytes JMP 76b387a2 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000755114f5 2 bytes JMP 76b38978 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007551150d 2 bytes JMP 76b38698 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075511525 2 bytes JMP 76b38a62 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007551153d 2 bytes JMP 76aafca8 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075511555 2 bytes JMP 76ab68ef C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007551156d 2 bytes JMP 76b38f61 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075511585 2 bytes JMP 76b38ac2 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007551159d 2 bytes JMP 76b3865c C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000755115b5 2 bytes JMP 76aafd41 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000755115cd 2 bytes JMP 76abb2dc C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000755116b2 2 bytes JMP 76b38e24 C:\Windows\syswow64\kernel32.dll .text D:\Dropbox\Uczelnia\nowy list mi這sny od Samsunga Julii\nowe\Defogger.exe[4752] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000755116bd 2 bytes JMP 76b385f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 00000000734d0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 00000000731c0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340](2015-02-16 10:17:52) 0000000073c50000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000068980000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (ICU I18N DLL/The ICU Project)(2015-02-16 10:17:52) 000000004a900000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (ICU Common DLL/The ICU Project)(2015-02-16 10:17:52) 0000000004420000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (ICU Data DLL/The ICU Project)(2015-02-16 10:17:52) 000000004ad00000 Library c:\users\julia\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmpz0tazx.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340](2015-03-06 14:56:58) 0000000004660000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000068f80000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000066710000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 00000000682b0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000067df0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000073a30000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340](2015-02-16 10:17:52) 0000000073fb0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000072dd0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 0000000072d90000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-02-16 10:17:52) 000000006a2c0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340](2015-02-16 10:32:36) 00000000697c0000 Library C:\Users\Julia\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Julia\AppData\Roaming\Dropbox\bin\Dropbox.exe [3340](2015-02-16 10:32:36) 0000000073b40000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b803058adc29 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 1091 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b803058adc29 (not active ControlSet) ---- EOF - GMER 2.1 ----