GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2014-01-14 22:26:54 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 WDC_WD20EARX-008FB0 rev.51.0AB51 1863,02GB Running: srfb1u1b.exe; Driver: C:\Users\Iskander\AppData\Local\Temp\awddikow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\PACE\Services\LicenseServices\LDSvc.exe[2076] C:\Windows\syswow64\kernel32.dll!CreateThread 0000000075cc3475 5 bytes JMP 0000000102453098 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075411465 2 bytes [41, 75] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000754114bb 2 bytes [41, 75] .text ... * 2 .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\SysWOW64\ksuser.dll!KsCreatePin + 35 00000000734611a8 2 bytes [46, 73] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\SysWOW64\ksuser.dll!KsCreateAllocator + 21 00000000734613a8 2 bytes [46, 73] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\SysWOW64\ksuser.dll!KsCreateClock + 21 0000000073461422 2 bytes [46, 73] .text C:\Program Files (x86)\Skype\Phone\Skype.exe[2616] C:\Windows\SysWOW64\ksuser.dll!KsCreateTopologyNode + 19 0000000073461498 2 bytes [46, 73] ---- Threads - GMER 2.1 ---- Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4136:4544] 000007fefafe2a7c Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4136:4720] 000007fef1554830 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4136:2648] 000007fef14d9d90 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [4136:6904] 000007fef1554830 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE7 0x1A 0xB5 0x63 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files (x86)\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x34 0x24 0x5C 0xF6 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x47 0xF5 0x4B 0x0F ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE7 0x1A 0xB5 0x63 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 D:\Program Files (x86)\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0x34 0x24 0x5C 0xF6 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0xA0 0x02 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x47 0xF5 0x4B 0x0F ... ---- Files - GMER 2.1 ---- File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e05e 0 bytes File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e05f 0 bytes File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e060 0 bytes File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e061 276140 bytes File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e062 0 bytes File C:\Users\Iskander\AppData\Local\Google\Chrome\User Data\Default\Cache\f_00e251 0 bytes File C:\Users\Iskander\AppData\Roaming\Microsoft\Windows\Recent\logo.png.lnk 437 bytes ---- EOF - GMER 2.1 ----