GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-06-06 17:14:33
Windows 6.2.9200  x64 
Running: gmer.exe


---- Services - GMER 2.2 ----

Service  C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys (*** hidden *** )                                                                [MANUAL] MBAMSwissArmy                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                            <-- ROOTKIT !!!

---- Registry - GMER 2.2 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed                                              1819752621
Reg      HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14943534834062294@SetupOperations                             ???3?????3?3?4?4?4?4????????????????????????????? ??????????????Commited???????????????????t???????????????????t?????????3???????????????????????????B??? ???????`???????????????????????????????????????????d??? ???????3???????????3???????? ??????????????????????????3??? ??Reverted? ???3?3?3?3?3?3????????????????????6??????????????????t?????????3??????????????????????????????????????????????? ??????????????? ???????3???????????3???????? ??????????????????????????3???<??Reverted?????3?3?3?3?3?3???????????????????t???????????????????t?????????3???????????????????<??????????????????????????? ??????????????? ???????3???????????3???????? ??????????????????????????3??????Reverted?????3?3?3?3?3?3???????????????????????????????????????t?????????3???????????????????????????????2??????????????? ??????????????? ???????3???????????3???????? ??????????????????????????3??????Reverted?????5???3??????????????MoveFile("\??\C:\Program Files\AVAST Software\Avast\avBB253.tmp","\??\C:\Program Files\AVAST Software\Avast\avBugReport
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@Type                                                                      2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@Start                                                                     3
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@ErrorControl                                                              1
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@Tag                                                                       6
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@ImagePath                                                                 \??\C:\WINDOWS\system32\drivers\MBAMSwissArmy.sys
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@DisplayName                                                               MBAMSwissArmy
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy@Group                                                                     FSFilter Activity Monitor
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy\Instances                                                                 
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy\Instances@DefaultInstance                                                 MBAMSwissArmy Instance
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy\Instances\MBAMSwissArmy Instance                                          
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy\Instances\MBAMSwissArmy Instance@Flags                                    0
Reg      HKLM\SYSTEM\CurrentControlSet\Services\MBAMSwissArmy                                                                           
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7a4548d7-cd89-49c3-b67a-317b236ed927}@LeaseObtainedTime    1496754360
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7a4548d7-cd89-49c3-b67a-317b236ed927}@T1                   1496756160
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7a4548d7-cd89-49c3-b67a-317b236ed927}@T2                   1496757510
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{7a4548d7-cd89-49c3-b67a-317b236ed927}@LeaseTerminatesTime  1496757960
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated                                            0x66 0xE3 0x98 0x89 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh                                                 0x66 0x4B 0x5D 0xEB ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow                                                  0x66 0x7B 0xD4 0x27 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                             0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                         0x64 0x62 0x03 0x00 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\Flighting@CachedFeatureString                                            
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@OperaSoftware.OperaWebBrowser.1455115975                    0xD7 0xE9 0x03 0x53 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{02F45559-7EAC-4DA4-B228-9542D9346E62}                        
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{02F45559-7EAC-4DA4-B228-9542D9346E62}@LastAccessedTime       0x30 0xEA 0x2B 0xD4 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{02F45559-7EAC-4DA4-B228-9542D9346E62}@AppId                  C:\Users\tom615\Desktop\HitmanPro_x64.exe
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{02F45559-7EAC-4DA4-B228-9542D9346E62}@LaunchCount            1
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A55DFD9E-6B99-4B10-8F59-EEDDF520A858}@LastAccessedTime       0x40 0x0A 0x76 0x1C ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{A55DFD9E-6B99-4B10-8F59-EEDDF520A858}@LaunchCount            22
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C0D0DE54-C4F2-4A4A-BAD1-F5B2069C3C4E}                        
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C0D0DE54-C4F2-4A4A-BAD1-F5B2069C3C4E}@LastAccessedTime       0xA0 0xEE 0x24 0xFC ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C0D0DE54-C4F2-4A4A-BAD1-F5B2069C3C4E}@AppId                  C:\Users\tom615\Desktop\flashplayer25pp_fa_install.exe
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{C0D0DE54-C4F2-4A4A-BAD1-F5B2069C3C4E}@LaunchCount            2
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{D1EBE300-71E4-4941-8301-1CE7F135D598}@LastAccessedTime       0x10 0xEE 0x84 0xE2 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\RecentApps\{D1EBE300-71E4-4941-8301-1CE7F135D598}@LaunchCount            6
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Security and Maintenance@MessageTime                                            0x90 0x80 0xD4 0xD9 ...

---- EOF - GMER 2.2 ----