GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-12-29 17:15:20 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.0003SDM1 465,76GB Running: 4yfcqhs3.exe; Driver: C:\Users\Admin\AppData\Local\Temp\awddakob.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000175600 7 bytes [00, 63, F3, FF, 41, 71, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000175608 3 bytes [C0, 06, 02] ---- User code sections - GMER 2.1 ---- .text C:\Riot Games\League of Legends\RADS\projects\lol_patcher\releases\0.0.0.45\deploy\LoLPatcher.exe[5348] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075618781 5 bytes [33, C0, C2, 04, 00] .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 00000000759b1401 2 bytes JMP 7563b21b C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 00000000759b1419 2 bytes JMP 7563b346 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 00000000759b1431 2 bytes JMP 756b8fd1 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 00000000759b144a 2 bytes CALL 7561489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000759b14dd 2 bytes JMP 756b88c4 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000759b14f5 2 bytes JMP 756b8aa0 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 00000000759b150d 2 bytes JMP 756b87ba C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 00000000759b1525 2 bytes JMP 756b8b8a C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 00000000759b153d 2 bytes JMP 7562fca8 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 00000000759b1555 2 bytes JMP 756368ef C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 00000000759b156d 2 bytes JMP 756b9089 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 00000000759b1585 2 bytes JMP 756b8bea C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 00000000759b159d 2 bytes JMP 756b877e C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000759b15b5 2 bytes JMP 7562fd41 C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000759b15cd 2 bytes JMP 7563b2dc C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000759b16b2 2 bytes JMP 756b8f4c C:\Windows\syswow64\kernel32.dll .text C:\Riot Games\League of Legends\RADS\projects\lol_air_client\releases\0.0.1.177\deploy\LolClient.exe[2288] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000759b16bd 2 bytes JMP 756b8713 C:\Windows\syswow64\kernel32.dll ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f683d7056 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f683d7056@64a769d973aa 0x6E 0x4E 0xD8 0x39 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f683d7056 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f683d7056@64a769d973aa 0x6E 0x4E 0xD8 0x39 ... ---- EOF - GMER 2.1 ----