GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-09-08 21:54:59 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST932032 rev.0005 298,09GB Running: gmer.exe; Driver: C:\Users\HP\AppData\Local\Temp\uxldipow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[2020] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\ProgramData\31f7a620-acbd-4f84-82db-5e231b8ad5de\plugincontainer.exe[548] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\TermCoach_1.10.0.22\Service\tcsvc.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\31f7a620-acbd-4f84-82db-5e231b8ad5de\updater.exe[2232] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\ALLPlayer\ALLUpdate.exe[2908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\OficynaMM\ndp\oficynaup.exe[2684] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe[3096] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe[3400] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000074da1401 2 bytes JMP 7662b20b C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000074da1419 2 bytes JMP 7662b336 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000074da1431 2 bytes JMP 766a8f39 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 0000000074da144a 2 bytes CALL 76604885 C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 0000000074da14dd 2 bytes JMP 766a8832 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 0000000074da14f5 2 bytes JMP 766a8a08 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 0000000074da150d 2 bytes JMP 766a8728 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000074da1525 2 bytes JMP 766a8af2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 0000000074da153d 2 bytes JMP 7661fc98 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000074da1555 2 bytes JMP 766268df C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 0000000074da156d 2 bytes JMP 766a8ff1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000074da1585 2 bytes JMP 766a8b52 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 0000000074da159d 2 bytes JMP 766a86ec C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 0000000074da15b5 2 bytes JMP 7661fd31 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 0000000074da15cd 2 bytes JMP 7662b2cc C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 0000000074da16b2 2 bytes JMP 766a8eb4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Hewlett-Packard\Shared\hpqwmiex.exe[4060] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 0000000074da16bd 2 bytes JMP 766a8681 C:\Windows\syswow64\kernel32.dll ---- Processes - GMER 2.1 ---- Library C:\Users\HP\AppData\Local\Temp\WindowsAPI.dll3564866588485871092.lib (*** suspicious ***) @ C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe [3096](2015-09-08 18:50:37) 0000000010000000 Library C:\Users\HP\AppData\Local\Temp\swt-win32-3448.dll (*** suspicious ***) @ C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe [3096] (SWT for Windows native library/Eclipse Foundation)(2013-06-01 13:57:21) 0000000006130000 Library C:\Users\HP\AppData\Local\Temp\swt-gdip-win32-3448.dll (*** suspicious ***) @ C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe [3096] (SWT for Windows native library/Eclipse Foundation)(2013-06-01 13:57:25) 0000000005eb0000 Library C:\Users\HP\AppData\Local\Temp\libsqlitejdbc-9103071197445105093.lib (*** suspicious ***) @ C:\Program Files (x86)\Hewlett-Packard\HP CloudDrive\zumodrive.exe [3096](2015-09-08 18:50:39) 000000006c2c0000 ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----