GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2016-02-13 12:50:35 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.PB4O 465,76GB Running: dp2dxv18.exe; Driver: C:\Users\Beata\AppData\Local\Temp\uwldrpog.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075371401 2 bytes JMP 74e9b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075371419 2 bytes JMP 74e9b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075371431 2 bytes JMP 74f19011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007537144a 2 bytes CALL 74e748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000753714dd 2 bytes JMP 74f1890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000753714f5 2 bytes JMP 74f18ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007537150d 2 bytes JMP 74f18800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075371525 2 bytes JMP 74f18bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007537153d 2 bytes JMP 74e8fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075371555 2 bytes JMP 74e96907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007537156d 2 bytes JMP 74f190c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075371585 2 bytes JMP 74f18c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007537159d 2 bytes JMP 74f187c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000753715b5 2 bytes JMP 74e8fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000753715cd 2 bytes JMP 74e9b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000753716b2 2 bytes JMP 74f18f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3264] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000753716bd 2 bytes JMP 74f18759 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075371401 2 bytes JMP 74e9b233 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075371419 2 bytes JMP 74e9b35e C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075371431 2 bytes JMP 74f19011 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007537144a 2 bytes CALL 74e748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000753714dd 2 bytes JMP 74f1890a C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000753714f5 2 bytes JMP 74f18ae0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007537150d 2 bytes JMP 74f18800 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075371525 2 bytes JMP 74f18bca C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007537153d 2 bytes JMP 74e8fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075371555 2 bytes JMP 74e96907 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007537156d 2 bytes JMP 74f190c9 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075371585 2 bytes JMP 74f18c2a C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007537159d 2 bytes JMP 74f187c4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000753715b5 2 bytes JMP 74e8fd59 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000753715cd 2 bytes JMP 74e9b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000753716b2 2 bytes JMP 74f18f8c C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\RunDll32.exe[868] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000753716bd 2 bytes JMP 74f18759 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\AVAST Software\Avast\avastui.exe[188] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000074e78791 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000075371401 2 bytes JMP 74e9b233 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000075371419 2 bytes JMP 74e9b35e C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000075371431 2 bytes JMP 74f19011 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007537144a 2 bytes CALL 74e748ad C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000753714dd 2 bytes JMP 74f1890a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000753714f5 2 bytes JMP 74f18ae0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007537150d 2 bytes JMP 74f18800 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000075371525 2 bytes JMP 74f18bca C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007537153d 2 bytes JMP 74e8fcc0 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000075371555 2 bytes JMP 74e96907 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007537156d 2 bytes JMP 74f190c9 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000075371585 2 bytes JMP 74f18c2a C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007537159d 2 bytes JMP 74f187c4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000753715b5 2 bytes JMP 74e8fd59 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000753715cd 2 bytes JMP 74e9b2f4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000753716b2 2 bytes JMP 74f18f8c C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5520] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000753716bd 2 bytes JMP 74f18759 C:\Windows\syswow64\kernel32.dll ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb115d31b Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001bb1d33403 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f65e35b Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\b4749f65e35b@002567b6e929 0x0C 0xDB 0x92 0xE4 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb115d31b (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001bb1d33403 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f65e35b (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\b4749f65e35b@002567b6e929 0x0C 0xDB 0x92 0xE4 ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----