GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-17 14:41:33 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD25 rev.11.0 232,89GB Running: ucvzfkjf.exe; Driver: C:\Users\Kacper\AppData\Local\Temp\fgldapod.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000774f1401 2 bytes JMP 75a1b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000774f1419 2 bytes JMP 75a1b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000774f1431 2 bytes JMP 75a98ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000774f144a 2 bytes CALL 759f48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000774f14dd 2 bytes JMP 75a987a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000774f14f5 2 bytes JMP 75a98978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000774f150d 2 bytes JMP 75a98698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000774f1525 2 bytes JMP 75a98a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000774f153d 2 bytes JMP 75a0fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000774f1555 2 bytes JMP 75a168ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000774f156d 2 bytes JMP 75a98f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000774f1585 2 bytes JMP 75a98ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000774f159d 2 bytes JMP 75a9865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000774f15b5 2 bytes JMP 75a0fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000774f15cd 2 bytes JMP 75a1b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000774f16b2 2 bytes JMP 75a98e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe[1076] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000774f16bd 2 bytes JMP 75a985f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000774f1401 2 bytes JMP 75a1b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000774f1419 2 bytes JMP 75a1b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000774f1431 2 bytes JMP 75a98ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000774f144a 2 bytes CALL 759f48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000774f14dd 2 bytes JMP 75a987a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000774f14f5 2 bytes JMP 75a98978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000774f150d 2 bytes JMP 75a98698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000774f1525 2 bytes JMP 75a98a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000774f153d 2 bytes JMP 75a0fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000774f1555 2 bytes JMP 75a168ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000774f156d 2 bytes JMP 75a98f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000774f1585 2 bytes JMP 75a98ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000774f159d 2 bytes JMP 75a9865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000774f15b5 2 bytes JMP 75a0fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000774f15cd 2 bytes JMP 75a1b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000774f16b2 2 bytes JMP 75a98e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000774f16bd 2 bytes JMP 75a985f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000748c11a8 2 bytes [8C, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 248 00000000748c127d 2 bytes CALL 759f14b9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 395 00000000748c1310 2 bytes CALL 759f14b9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000748c13a8 2 bytes [8C, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 00000000748c1422 2 bytes [8C, 74] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2292] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 00000000748c1498 2 bytes [8C, 74] .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000774f1401 2 bytes JMP 75a1b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000774f1419 2 bytes JMP 75a1b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000774f1431 2 bytes JMP 75a98ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000774f144a 2 bytes CALL 759f48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000774f14dd 2 bytes JMP 75a987a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000774f14f5 2 bytes JMP 75a98978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000774f150d 2 bytes JMP 75a98698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000774f1525 2 bytes JMP 75a98a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000774f153d 2 bytes JMP 75a0fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000774f1555 2 bytes JMP 75a168ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000774f156d 2 bytes JMP 75a98f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000774f1585 2 bytes JMP 75a98ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000774f159d 2 bytes JMP 75a9865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000774f15b5 2 bytes JMP 75a0fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000774f15cd 2 bytes JMP 75a1b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000774f16b2 2 bytes JMP 75a98e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[2552] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000774f16bd 2 bytes JMP 75a985f1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000774f1401 2 bytes JMP 75a1b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000774f1419 2 bytes JMP 75a1b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000774f1431 2 bytes JMP 75a98ea9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000774f144a 2 bytes CALL 759f48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000774f14dd 2 bytes JMP 75a987a2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000774f14f5 2 bytes JMP 75a98978 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000774f150d 2 bytes JMP 75a98698 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000774f1525 2 bytes JMP 75a98a62 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000774f153d 2 bytes JMP 75a0fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000774f1555 2 bytes JMP 75a168ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000774f156d 2 bytes JMP 75a98f61 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000774f1585 2 bytes JMP 75a98ac2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000774f159d 2 bytes JMP 75a9865c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000774f15b5 2 bytes JMP 75a0fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000774f15cd 2 bytes JMP 75a1b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000774f16b2 2 bytes JMP 75a98e24 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[2700] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000774f16bd 2 bytes JMP 75a985f1 C:\Windows\syswow64\kernel32.dll ? C:\Windows\system32\mssprxy.dll [2700] entry point in ".rdata" section 00000000737771e6 .text C:\Windows\SysWOW64\PnkBstrA.exe[3044] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 00000000718817fa 2 bytes CALL 759f11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3044] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000071881860 2 bytes CALL 759f11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3044] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000071881942 2 bytes JMP 76e77089 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrA.exe[3044] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 000000007188194d 2 bytes JMP 76e7cba6 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 00000000718817fa 2 bytes CALL 759f11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000071881860 2 bytes CALL 759f11a9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000071881942 2 bytes JMP 76e77089 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 000000007188194d 2 bytes JMP 76e7cba6 C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 00000000774f1401 2 bytes JMP 75a1b21b C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 00000000774f1419 2 bytes JMP 75a1b346 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 00000000774f1431 2 bytes JMP 75a98ea9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 00000000774f144a 2 bytes CALL 759f48ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000774f14dd 2 bytes JMP 75a987a2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000774f14f5 2 bytes JMP 75a98978 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 00000000774f150d 2 bytes JMP 75a98698 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 00000000774f1525 2 bytes JMP 75a98a62 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 00000000774f153d 2 bytes JMP 75a0fca8 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 00000000774f1555 2 bytes JMP 75a168ef C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 00000000774f156d 2 bytes JMP 75a98f61 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 00000000774f1585 2 bytes JMP 75a98ac2 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 00000000774f159d 2 bytes JMP 75a9865c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000774f15b5 2 bytes JMP 75a0fd41 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000774f15cd 2 bytes JMP 75a1b2dc C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000774f16b2 2 bytes JMP 75a98e24 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\PnkBstrB.exe[2596] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000774f16bd 2 bytes JMP 75a985f1 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtCore4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2416](2 000000006a1c0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\mingwm10.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2416] 000000006fbc0000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\libgcc_s_dw2-1.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2416](2014-10-17 14:07:32) 000000006e940000 Library C:\ProgramData\PLAY ONLINE\OnlineUpdate\QtNetwork4.dll (*** suspicious ***) @ C:\ProgramData\PLAY ONLINE\OnlineUpdate\ouc.exe [2416](2014-10-17 14:07:32) 000000006ff00000 ---- EOF - GMER 2.1 ----