GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-06-03 20:29:46 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000064 ST925031 rev.0001 232,89GB Running: 4sg9ynd1.exe; Driver: C:\Users\Jarek\AppData\Local\Temp\fwldykog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076668781 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000076451401 2 bytes JMP 7668b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000076451419 2 bytes JMP 7668b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000076451431 2 bytes JMP 76708f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007645144a 2 bytes CALL 7666489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000764514dd 2 bytes JMP 76708822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000764514f5 2 bytes JMP 767089f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007645150d 2 bytes JMP 76708718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076451525 2 bytes JMP 76708ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007645153d 2 bytes JMP 7667fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000076451555 2 bytes JMP 766868ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007645156d 2 bytes JMP 76708fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000076451585 2 bytes JMP 76708b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007645159d 2 bytes JMP 767086dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000764515b5 2 bytes JMP 7667fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000764515cd 2 bytes JMP 7668b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000764516b2 2 bytes JMP 76708ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000764516bd 2 bytes JMP 76708671 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExW + 17 0000000076451401 2 bytes JMP 7668b21b C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!EnumProcessModules + 17 0000000076451419 2 bytes JMP 7668b346 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 17 0000000076451431 2 bytes JMP 76708f29 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleInformation + 42 000000007645144a 2 bytes CALL 7666489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!EnumDeviceDrivers + 17 00000000764514dd 2 bytes JMP 76708822 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameA + 17 00000000764514f5 2 bytes JMP 767089f8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!QueryWorkingSetEx + 17 000000007645150d 2 bytes JMP 76708718 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetDeviceDriverBaseNameW + 17 0000000076451525 2 bytes JMP 76708ae2 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameW + 17 000000007645153d 2 bytes JMP 7667fca8 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!EnumProcesses + 17 0000000076451555 2 bytes JMP 766868ef C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetProcessMemoryInfo + 17 000000007645156d 2 bytes JMP 76708fe3 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetPerformanceInfo + 17 0000000076451585 2 bytes JMP 76708b42 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!QueryWorkingSet + 17 000000007645159d 2 bytes JMP 767086dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleBaseNameA + 17 00000000764515b5 2 bytes JMP 7667fd41 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetModuleFileNameExA + 17 00000000764515cd 2 bytes JMP 7668b2dc C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 20 00000000764516b2 2 bytes JMP 76708ea4 C:\Windows\syswow64\kernel32.dll .text C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe[1044] C:\Windows\syswow64\Psapi.dll!GetProcessImageFileNameW + 31 00000000764516bd 2 bytes JMP 76708671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000076451401 2 bytes JMP 7668b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000076451419 2 bytes JMP 7668b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000076451431 2 bytes JMP 76708f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007645144a 2 bytes CALL 7666489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000764514dd 2 bytes JMP 76708822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000764514f5 2 bytes JMP 767089f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007645150d 2 bytes JMP 76708718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000076451525 2 bytes JMP 76708ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007645153d 2 bytes JMP 7667fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000076451555 2 bytes JMP 766868ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007645156d 2 bytes JMP 76708fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000076451585 2 bytes JMP 76708b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007645159d 2 bytes JMP 767086dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000764515b5 2 bytes JMP 7667fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000764515cd 2 bytes JMP 7668b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000764516b2 2 bytes JMP 76708ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ASUS\GPU Tweak\Monitor.exe[3196] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000764516bd 2 bytes JMP 76708671 C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.1 ---- Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2624:2092] 000007fefb542bf8 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2624:3136] 000007feddcacf60 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2624:4328] 000007fef93d5124 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2624:5676] 000007feddc11b54 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [2624:5680] 000007feddcacf60 ---- Processes - GMER 2.1 ---- Library C:\Users\Jarek\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [2728] (GG drive menu/GG Network S.A.)(201 000000005ff80000 Library C:\Users\Jarek\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries25.gadget\IntelDTSReader.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2932] (IntelDTSReader/Orbmu2k)(2015-03-27 23:02:18) 000000006e0d0000 Library C:\Users\Jarek\AppData\Local\Microsoft\Windows Sidebar\Gadgets\IntelCoreSeries25.gadget\WinRing0x64.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2932] (WinRing0/OpenLibSys.org)(2015-03-27 23:02:17) 0000000180000000 Library c:\users\jarek\appdata\local\temp\dropbox_sqlite_ext.{5f3e3153-5bce-5766-8f84-3e3e7ecf0d81}.tmp2g7dzw.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044](2015-06-03 17:20:35) 0000000003d70000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Core.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000073c70000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\icuin52.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (ICU I18N DLL/The ICU Project)(2015-05-23 10:33:48) 000000004a900000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\icuuc52.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (ICU Common DLL/The ICU Project)(2015-05-23 10:33:48) 0000000005e60000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\icudt52.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (ICU Data DLL/The ICU Project)(2015-05-23 10:33:48) 000000004ad00000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Widgets.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000070710000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Gui.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000070420000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\libGLESv2.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044](2015-05-23 10:33:48) 00000000739b0000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Network.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000070070000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5WebKit.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 000000006f080000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Quick.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 000000006ecb0000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Qml.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 000000006ea50000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5Sql.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000073970000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\libEGL.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044](2015-05-23 10:33:48) 0000000074990000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5WebKitWidgets.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000073940000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5OpenGL.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 0000000073900000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Qt5PrintSupport.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044] (C++ application development framework./Digia Plc and/or its subsidiary(-ies))(2015-05-23 10:33:48) 00000000738b0000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\plugins\platforms\qwindows.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044](2015-05-23 10:33:48) 000000006efa0000 Library C:\Users\Jarek\AppData\Roaming\Dropbox\bin\plugins\imageformats\qjpeg.dll (*** suspicious ***) @ C:\Users\Jarek\AppData\Roaming\Dropbox\bin\Dropbox.exe [1044](2015-05-23 10:33:48) 000000006ef60000 ---- EOF - GMER 2.1 ----