GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-07-30 08:04:27 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000031 ST500LT012-1DG142 rev.0002SDM1 465,76GB Running: wpl0k3ex.exe; Driver: C:\Users\Kasia\AppData\Local\Temp\fxldrpoc.sys ---- User code sections - GMER 2.2 ---- .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleInformation 00007fff4be13e10 7 bytes JMP 00007fff4b2f02d0 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!RegQueryValueExW 00007fff4be13e20 7 bytes JMP 00007fff4b2f0308 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExW 00007fff4bec39b0 7 bytes JMP 00007fff4b2f03b0 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!RegDeleteValueW 00007fff4bec3ef0 7 bytes JMP 00007fff4b2f0340 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!RegSetValueExA 00007fff4bec3fe0 7 bytes JMP 00007fff4b2f0378 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!K32EnumProcessModulesEx 00007fff4bef06c0 7 bytes JMP 00007fff4b2f0228 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!K32GetMappedFileNameW 00007fff4bef0730 7 bytes JMP 00007fff4b2f0298 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNEL32.DLL!K32GetModuleFileNameExW 00007fff4bef0760 7 bytes JMP 00007fff4b2f0260 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNELBASE.dll!FreeLibrary 00007fff4b3521d0 5 bytes JMP 00007fff4b2f0180 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleW 00007fff4b3529d0 7 bytes JMP 00007fff4b2f00d8 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNELBASE.dll!GetModuleHandleExW 00007fff4b354310 5 bytes JMP 00007fff4b2f0110 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\KERNELBASE.dll!LoadLibraryExW 00007fff4b358c40 5 bytes JMP 00007fff4b2f0148 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\USER32.dll!CreateWindowExW 00007fff4c239920 10 bytes JMP 00007fff4b2f0490 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesW 00007fff4c244430 5 bytes JMP 00007fff4b2f0458 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\USER32.dll!DisplayConfigGetDeviceInfo 00007fff4c2444f0 9 bytes JMP 00007fff4b2f03e8 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\USER32.dll!EnumDisplayDevicesA 00007fff4c253b80 5 bytes JMP 00007fff4b2f0420 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\GDI32.dll!D3DKMTGetDisplayModeList 00007fff4bc81500 8 bytes JMP 00007fff4b2f01b8 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\GDI32.dll!D3DKMTQueryAdapterInfo 00007fff4bc81750 8 bytes JMP 00007fff4b2f01f0 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\dxgi.dll!CreateDXGIFactory 00007fff49137750 5 bytes JMP 00007fff48fb00d8 .text C:\WINDOWS\system32\dwm.exe[952] C:\WINDOWS\system32\dxgi.dll!CreateDXGIFactory1 00007fff49138ee0 5 bytes JMP 00007fff48fb0110 ---- Threads - GMER 2.2 ---- Thread C:\WINDOWS\system32\csrss.exe [640:664] fffff960008642d0 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -494526488 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\RAC_PS@Start 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\54271e153d2a Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Upgrade\LocalRadioSettings Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 1946 Reg HKLM\SYSTEM\CurrentControlSet\Services\W32Time\TimeProviders\NtpClient@SpecialPollTimeRemaining time.windows.com,7d1145d??????????? Reg HKLM\SYSTEM\CurrentControlSet\Services\WinDefend@FailureCommand C:\WINDOWS\system32\mrt.exe /EHB /ServiceFailure "CAMP=4.8.207.0;approximate-> Engine=1.1.12902.0;AVSIG=1.225.2604.0;ASSIG=1.225.2604.0" /StartService /Defender /q Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@RwMask 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\3@RwMask 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\4@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\4@RwMask 0x64 0x62 0x03 0x00 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\GWX\Usage@UsageTime 0x20 0xB2 0x4C 0xAD ... ---- Disk sectors - GMER 2.2 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.2 ----