GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-07-14 20:54:07 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\00000068 ATA_____ rev.BBF0 111,79GB Running: tm34xxnn.exe; Driver: D:\TEMP\axldypow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2468] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000075552ab1 5 bytes JMP 00000001003bf046 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077171401 2 bytes JMP 75b7b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077171419 2 bytes JMP 75b7b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077171431 2 bytes JMP 75bf8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007717144a 2 bytes CALL 75b5489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000771714dd 2 bytes JMP 75bf8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000771714f5 2 bytes JMP 75bf89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007717150d 2 bytes JMP 75bf8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077171525 2 bytes JMP 75bf8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007717153d 2 bytes JMP 75b6fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077171555 2 bytes JMP 75b768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007717156d 2 bytes JMP 75bf8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077171585 2 bytes JMP 75bf8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007717159d 2 bytes JMP 75bf86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000771715b5 2 bytes JMP 75b6fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000771715cd 2 bytes JMP 75b7b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000771716b2 2 bytes JMP 75bf8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgui.exe[2704] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000771716bd 2 bytes JMP 75bf8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000077171401 2 bytes JMP 75b7b21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000077171419 2 bytes JMP 75b7b346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000077171431 2 bytes JMP 75bf8f29 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007717144a 2 bytes CALL 75b5489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000771714dd 2 bytes JMP 75bf8822 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000771714f5 2 bytes JMP 75bf89f8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007717150d 2 bytes JMP 75bf8718 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077171525 2 bytes JMP 75bf8ae2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007717153d 2 bytes JMP 75b6fca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000077171555 2 bytes JMP 75b768ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007717156d 2 bytes JMP 75bf8fe3 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000077171585 2 bytes JMP 75bf8b42 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007717159d 2 bytes JMP 75bf86dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000771715b5 2 bytes JMP 75b6fd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000771715cd 2 bytes JMP 75b7b2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000771716b2 2 bytes JMP 75bf8ea4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgfws.exe[3012] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000771716bd 2 bytes JMP 75bf8671 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe[3588] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 0000000177830128 .text C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe[3588] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 0000000177830018 .text C:\Program Files (x86)\AVG\AVG2015\avgnsa.exe[3588] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000778300a0 .text C:\Program Files (x86)\AVG\AVG2015\avgemca.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 0000000177830128 .text C:\Program Files (x86)\AVG\AVG2015\avgemca.exe[3624] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 0000000177830018 .text C:\Program Files (x86)\AVG\AVG2015\avgemca.exe[3624] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000778300a0 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[3336] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe[3336] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Windows\system32\conhost.exe[3288] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Windows\system32\conhost.exe[3288] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Windows\system32\conhost.exe[3288] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3192] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3192] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe[3192] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Windows\system32\conhost.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Windows\system32\conhost.exe[4028] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Windows\system32\conhost.exe[4028] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Windows\System32\WUDFHost.exe[3316] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Windows\System32\WUDFHost.exe[3316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Windows\System32\WUDFHost.exe[3316] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Windows\system32\svchost.exe[4316] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 0000000177830128 .text C:\Windows\system32\svchost.exe[4316] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 0000000177830018 .text C:\Windows\system32\svchost.exe[4316] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000778300a0 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4480] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4480] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Program Files\NVIDIA Corporation\Display\nvtray.exe[4480] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Windows\system32\GWX\GWX.exe[5140] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Windows\system32\GWX\GWX.exe[5140] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Windows\system32\GWX\GWX.exe[5140] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5644] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077a3fc9c 5 bytes JMP 0000000173f819c0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5644] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077a3fe60 5 bytes JMP 0000000173f815e0 .text C:\Program Files\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[5644] C:\Windows\syswow64\KERNEL32.dll!CreateProcessInternalW 0000000075b63bab 5 bytes JMP 0000000173f81750 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2028] C:\Windows\SysWOW64\ntdll.dll!NtMapViewOfSection 0000000077a3fc9c 5 bytes JMP 0000000173f819c0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2028] C:\Windows\SysWOW64\ntdll.dll!NtWriteVirtualMemory 0000000077a3fe60 5 bytes JMP 0000000173f815e0 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2028] C:\Windows\syswow64\kernel32.dll!CreateProcessInternalW 0000000075b63bab 5 bytes JMP 0000000173f81750 .text C:\Windows\system32\svchost.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 0000000177830128 .text C:\Windows\system32\svchost.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 0000000177830018 .text C:\Windows\system32\svchost.exe[2104] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000778300a0 .text C:\Windows\system32\wbem\wmiprvse.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection 000000007788de30 5 bytes JMP 00000000779f0128 .text C:\Windows\system32\wbem\wmiprvse.exe[5972] C:\Windows\SYSTEM32\ntdll.dll!NtWriteVirtualMemory 000000007788df50 5 bytes JMP 00000000779f0018 .text C:\Windows\system32\wbem\wmiprvse.exe[5972] C:\Windows\system32\kernel32.dll!CreateProcessInternalW 000000007763dbc0 5 bytes JMP 00000000779f00a0 ---- EOF - GMER 2.1 ----