GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-12-03 17:46:06 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\00000075 ST2000DM rev.CC29 1863,02GB Running: fdu1t8mm.exe; Driver: C:\Users\PC\AppData\Local\Temp\uglcraoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[3376] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 00000000775a1bb2 5 bytes JMP 0000000100b31179 .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075791401 2 bytes JMP 757ceb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075791419 2 bytes JMP 757db513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075791431 2 bytes JMP 75858609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007579144a 2 bytes CALL 757b1dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000757914dd 2 bytes JMP 75857efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000757914f5 2 bytes JMP 758580d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007579150d 2 bytes JMP 75857df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075791525 2 bytes JMP 758581c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007579153d 2 bytes JMP 757cf088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075791555 2 bytes JMP 757db885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007579156d 2 bytes JMP 758586c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075791585 2 bytes JMP 75858222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007579159d 2 bytes JMP 75857db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000757915b5 2 bytes JMP 757cf121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000757915cd 2 bytes JMP 757db29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000757916b2 2 bytes JMP 75858584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Norton Security with Backup\Engine\22.5.5.15\coNatHst.exe[5044] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000757916bd 2 bytes JMP 75857d4d C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\Users\PC\AppData\Local\NVIDIA\NvBackend\ApplicationOntology\Ontology.dll (*** suspicious ***) @ C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe [3376] (Application Ontology library/NVIDIA Corporation)(2015-12-01 13:33:16) 000000006f6c0000 ---- EOF - GMER 2.1 ----