GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2016-01-06 19:40:54 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 TOSHIBA_ rev.GJ00 465,76GB Running: c7g7ni2b.exe; Driver: C:\Users\euro\AppData\Local\Temp\aftcyaod.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\AVAST Software\Avast\AvastUI.exe[4720] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000076698781 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075141401 2 bytes JMP 766bb21b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075141419 2 bytes JMP 766bb346 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075141431 2 bytes JMP 76738fd1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007514144a 2 bytes CALL 7669489d C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000751414dd 2 bytes JMP 767388c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000751414f5 2 bytes JMP 76738aa0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007514150d 2 bytes JMP 767387ba C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075141525 2 bytes JMP 76738b8a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007514153d 2 bytes JMP 766afca8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075141555 2 bytes JMP 766b68ef C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007514156d 2 bytes JMP 76739089 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075141585 2 bytes JMP 76738bea C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007514159d 2 bytes JMP 7673877e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000751415b5 2 bytes JMP 766afd41 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000751415cd 2 bytes JMP 766bb2dc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000751416b2 2 bytes JMP 76738f4c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\gmsd_pl_005010199\gmsd_pl_005010199.exe[6492] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000751416bd 2 bytes JMP 76738713 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{8B404787-8A0E-4EE0-8862-6B0CBF0F86D8}\offreg.2940.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2940](2016-01-06 14:02:17) 000007fef9d00000 Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [4236] (GG drive overlay/GG Network S.A.)(2013-03-08 17:22:36) 000000005c080000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb115d31b Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb1d33403 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f63b509 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f63b509@00eb2d9c4d24 0xF9 0x4F 0xCD 0xAD ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb115d31b (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb1d33403 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f63b509 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f63b509@00eb2d9c4d24 0xF9 0x4F 0xCD 0xAD ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- Files - GMER 2.1 ---- File C:\Windows\Temp\SEPBD88.tmp 0 bytes ---- EOF - GMER 2.1 ----