GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2016-10-16 13:03:26
Windows 6.1.7600  x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1 ST3500418AS rev.CC46 465,76GB
Running: i7ib141w.exe; Driver: C:\Users\rmk\AppData\Local\Temp\uxriipow.sys


---- Kernel code sections - GMER 2.2 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                              suspicious modification

---- User code sections - GMER 2.2 ----

.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                                                                     00000000769c1401 2 bytes JMP 7742eb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                                                       00000000769c1419 2 bytes JMP 7743b513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                                                                     00000000769c1431 2 bytes JMP 774b8609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                                                                     00000000769c144a 2 bytes CALL 77411dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                                                                                           * 9
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                                                        00000000769c14dd 2 bytes JMP 774b7efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                                                                 00000000769c14f5 2 bytes JMP 774b80d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                                                        00000000769c150d 2 bytes JMP 774b7df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                                                                 00000000769c1525 2 bytes JMP 774b81c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                                                       00000000769c153d 2 bytes JMP 7742f088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                                                            00000000769c1555 2 bytes JMP 7743b885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                                                                     00000000769c156d 2 bytes JMP 774b86c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                                                       00000000769c1585 2 bytes JMP 774b8222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                                                          00000000769c159d 2 bytes JMP 774b7db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                                                       00000000769c15b5 2 bytes JMP 7742f121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                                                                     00000000769c15cd 2 bytes JMP 7743b29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                                                                 00000000769c16b2 2 bytes JMP 774b8584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files (x86)\Logitech\LWS\Webcam Software\LWS.exe[2692] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                                                                 00000000769c16bd 2 bytes JMP 774b7d4d C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\AVAST Software\Avast\avastui.exe[2848] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                          000000007741d03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...]

---- User IAT/EAT - GMER 2.2 ----

IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamDWord]       [7fef7e0741c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSet]                    [7fef7e05f10] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmEndSession]             [7fef7e05674] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartSession]           [7fef7e05e2c] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmStartUpload]            [7fef7e07f48] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppVersion]          [7fef7e06a38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetMachineId]           [7fef7e06ee8] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmWriteSharedMachineId]   [7fef7e07b58] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmCreateNewId]            [7fef7e07ea0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmReadSharedMachineId]    [7fef7e078b0] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmGetSession]             [7fef7e04fb4] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmSetAppId]               [7fef7e05d38] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll
IAT       C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[2360] @ C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE[sqmapi.dll!SqmAddToStreamString]      [7fef7e07584] C:\Program Files\Common Files\Microsoft Shared\Windows Live\sqmapi.dll

---- Kernel code sections - GMER 2.2 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                              suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                              suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                              suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                                                                                              suspicious modification

---- Registry - GMER 2.2 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\Instup_14738375177032280@SetupOperations                                                                                            ???f?|??1002-439c?Internal_IDE_Channel???????????????????h???3???8????<??n????????h???????P??j?????????n?????e?f?f?f?g??????????????P???????????NO_DRV_X?/??? ???????f?????f???????.?????????????????3??? ???????f?????f?????r?.??"?????z??????????0?????i?i?`???????????d??c%???????????????????????????????|???????f??? ???????????j????X??????.???.??5&a2234ed&0?2-???? ??;??????p????????????\??????pD??????????????t??????f???f????{177a55fc-386b-11e1-bb8e-0025227cbb29}??????????????????t????????????????????????t?????????????????????????s?3???????/???????????????????????????????????????????????|???s??????????????????? ???????f???????????f?,??????$????????????????.?&???????????.?????????.?/???????f ??e????????r??????f???????????????f?fRV???/??? ???????????????????f?0?????????????????????????????????????????f???-??25??6.1.7600.16385?e10???f?f????? ?????????????f???????0????????????????????????????????????????? ???????f???????????f?0?????????????????????????????????????????f??????????Kontroler DMA??????f????? ?????????????
Reg       HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\Instup_14738375568122280@SetupOperations                                                                                            ?????t???????????????????f????????:??????l?g\????????????????????????????1???????C??@machine.inf,%ati_mfg%;ATI??????{4d36e97d-e325-11ce-bfc1-08002be10318}\0034?????WFP Lightweight Filter?????????????????????????????????t?????$???????m??????????????????ca???$???????h???????????????????n??{8ECC055D-047F-11D1-A537-0000F8753ED1}???????(???.??????????????????????????Sterownik Realtek 8167 NT Driver?????????.??????????????????????????????{6bdd1fc6-810f-11d0-bec7-08002be2092f}\0000?17??????oo???i??WUDFRd???????????????????????????????d???????????$???????h???????????????????n??????0???????????????Extended Base?????(?????????????{4d36e96b-e325-11ce-bfc1-08002be10318}\0001?? ??{745a17a0-74d3-11d0-b6fe-00a0c90f57da}\0021?????.NTAMD64????{8ECC055D-047F-11D1-A537-0000F8753ED1}?pnp???????j?????????e?????h???????????f???e??????????????????????????????????????????????@disk.inf,%disk_devdesc%;Stacja dysk?w?row??????????????????????????????????????????$???4????? ??????? ??????????????????????????????????????????????????????? 
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\Instup_14738375177032280@SetupOperations                                                                                                ????????????????????????????????????????????????????????????????????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=6|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=upnphost|Name=@FirewallAPI.dll,-30523|Desc=@FirewallAPI.dll,-30524|EmbedCtxt=@FirewallAPI.dll,-30502|??????????|???? l??????1???????????????????????????????????t???????????k??USBSTOR\DiskSanDisk_Cruzer_Edge_____1.26?USBSTOR\DiskSanDisk_Cruzer_Edge_____?USBSTOR\DiskSanDisk_?USBSTOR\SanDisk_Cruzer_Edge_____1?SanDisk_Cruzer_Edge_____1?USBSTOR\GenDisk?GenDisk??????Sterownik urz?dzenia terminalu?NTa????*??????_?????????nDr??USBSTOR\DiskUFD_2.0_Silicon-Power4G_1100?USBSTOR\DiskUFD_2.0_Silicon-Power4G_?USBSTOR\DiskUFD_2.0_?USBSTOR\UFD_2.0_Silicon-Power4G_1?UFD_2.0_Silicon-Power4G_1?USBSTOR\GenDisk?GenDisk??????{d14fb278-cff0-5b1e-a3ea-f1b58ef41c3b}??????{4d36e967-e325-11ce-bfc1-08002be10318}?/?/??{4d36e967-e325-11ce-bfc1-08002be10318}\0008??.??@disk.inf,%genmanufacturer%;(Standardowe stacje dysk?w)?1a??UFD 2.0 Silicon-Power4G
Reg       HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\Instup_14738375568122280@SetupOperations                                                                                                ????????? ???????f???????????f?,??????$????????????????.?&??????????????????????KS??? ???????f???????????d?.??????"?h????????f??h???????????????????????????????????????????????????53??? <??g??????????????53?????f???g?????f??????????????? ???????g?????????????,?????????????????????y??? ???????f???????????_?.??????"??????????f???????f ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? ????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????????? ? ??????????????????????????????????????????? ????????????????????????
Reg       HKCU\Software\Microsoft\Windows NT\CurrentVersion\AppCompatFlags\Compatibility Assistant\Persisted@C:\Users\rmk\AppData\Local\Logitech\xae Webcam Software\Logishrd\LU2.0\LogitechUpdate.exe  1

---- EOF - GMER 2.2 ----