GMER 2.1.19355 - http://www.gmer.net
Rootkit scan 2014-01-25 16:12:18
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB
Running: uw5xilhh.exe; Driver: C:\Users\Kinga\AppData\Local\Temp\kxtiiaob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                               fffff800047fe000 45 bytes [00, 00, 10, 02, 4E, 74, 66, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                               fffff800047fe02f 29 bytes [00, 01, 00, 06, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1672] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                   0000000075ce1465 2 bytes [CE, 75]
.text     C:\Program Files (x86)\Common Files\ArcSoft\Connection Service\Bin\ACService.exe[1672] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                  0000000075ce14bb 2 bytes [CE, 75]
.text     ...                                                                                                                                                              * 2
.text     C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2012\avp.exe[1716] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                         0000000077da0038 5 bytes JMP 000000016ac91765
.text     C:\Program Files (x86)\Plus Internet\Plus Internet.exe[3432] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                             0000000075ce1465 2 bytes [CE, 75]
.text     C:\Program Files (x86)\Plus Internet\Plus Internet.exe[3432] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                            0000000075ce14bb 2 bytes [CE, 75]
.text     ...                                                                                                                                                              * 2
.text     C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3852] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                           0000000075ce1465 2 bytes [CE, 75]
.text     C:\Program Files (x86)\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe[3852] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                          0000000075ce14bb 2 bytes [CE, 75]
.text     ...                                                                                                                                                              * 2

---- User IAT/EAT - GMER 2.1 ----

IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!wctomb]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!iswctype]                                                           [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!wcstombs]                                                           [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!realloc]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!__badioinfo]                                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_read]                                                              [1] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_fileno]                                                            [18f4d40] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_isatty]                                                            [ffffffff] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!ungetc]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_iob]                                                               [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!localeconv]                                                         [fa0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!isxdigit]                                                           [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!isleadbyte]                                                         [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!__mb_cur_max]                                                       [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!mbtowc]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!isdigit]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!calloc]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_CxxThrowException]                                                 [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!memset]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!memcpy]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!??1type_info@@UEAA@XZ]                                              [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_onexit]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_lock]                                                              [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!__dllonexit]                                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_unlock]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!?terminate@@YAXXZ]                                                  [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_amsg_exit]                                                         [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_initterm]                                                          [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_XcptFilter]                                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_resetstkoflw]                                                      [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!?_set_se_translator@@YAP6AXIPEAU_EXCEPTION_POINTERS@@@ZP6AXI0@Z@Z]  [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_errno]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!__CxxFrameHandler]                                                  [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_purecall]                                                          [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_vsnwprintf]                                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!malloc]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!free]                                                               [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!__pioinfo]                                                          [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!_wfopen]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!fread]                                                              [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!ftell]                                                              [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!fseek]                                                              [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!fclose]                                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!wcschr]                                                             [4a7160] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!strncmp]                                                            [54fb10] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[msvcrt.dll!memmove]                                                            [4c5320] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!FlushFileBuffers]                                                 [7feeae1a638] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!WriteFile]                                                        [7feeae1a6c0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!SetFilePointer]                                                   [7feeae1a6cc] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!SetUnhandledExceptionFilter]                                      [7feeae1a6d8] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!UnhandledExceptionFilter]                                         [7feeae1a6e4] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetCurrentProcess]                                                [7feeae1a6f0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!TerminateProcess]                                                 [7feeae1a6fc] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetSystemTimeAsFileTime]                                          [7feeae1a708] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetCurrentProcessId]                                              [7feeae1a714] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetTickCount]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!QueryPerformanceCounter]                                          [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!RtlCaptureContext]                                                [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!RtlLookupFunctionEntry]                                           [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!RtlVirtualUnwind]                                                 [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!OutputDebugStringA]                                               [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetModuleFileNameW]                                               [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetCurrentThreadId]                                               [19d3bd0dbf40] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetLocalTime]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!FormatMessageW]                                                   [4ad2c0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!Sleep]                                                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!VirtualProtect]                                                   [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!DelayLoadFailureHook]                                             [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!LoadLibraryExA]                                                   [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!LocalFree]                                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!CloseHandle]                                                      [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!LockResource]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!CreateFileMappingW]                                               [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!DisableThreadLibraryCalls]                                        [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetProcAddress]                                                   [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!SetLastError]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetLastError]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!CreateFileW]                                                      [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!SizeofResource]                                                   [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!InitializeCriticalSectionAndSpinCount]                            [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!LoadLibraryW]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!LoadResource]                                                     [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!FreeLibrary]                                                      [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!FindResourceW]                                                    [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!UnmapViewOfFile]                                                  [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!MapViewOfFile]                                                    [0] 
IAT       C:\windows\system32\SearchIndexer.exe[2812] @ C:\windows\System32\NLSData0003.dll[KERNEL32.dll!GetFileSize]                                                      [0] 

---- Threads - GMER 2.1 ----

Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:2692]                                                                                            0000000075cc7587
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:1500]                                                                                            0000000071b47712
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:2976]                                                                                            0000000077dd2e65
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:928]                                                                                             0000000077dd3e85
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:2788]                                                                                            0000000077dd3e85
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [424:5000]                                                                                            0000000077dd3e85
---- Processes - GMER 2.1 ----

Library   C:\Users\Kinga\AppData\Roaming\GG\ggdrive\ggdrive-menu.dll (*** suspicious ***) @ C:\windows\Explorer.EXE [2716]                                                 000000005ff80000

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\4cedde049834 (not active ControlSet)                                                                  
Reg       HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\4cedde049834@1814569234d9                                                                             0xEF 0x38 0x09 0xEB ...
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanServer\Linkage@Bind                                                                                                     ???8??????|??<??????????? ???  ??8??????????s????????0???????e???8???????????e???y??*6to4mp??????8???r?r?*??\\?\USB#VID_058F&PID_6335#058F63356336#{a5dcbf10-6530-11d2-901f-00c04fb951ed}????8????z??<???????????????8????N??s????????D???????$??:???????????????8???<?f?????8???????????1??????????ACPI\Processor???????r?s?-????$??8????????????????z??<??? ????????????N??h???????D??tunnel??6?????\??r???????????????????????????e????N??u???b????Db39???s?se????????<???????????????? ??????3???e???8???????????????????????????4???????????????8???<?=?<??????????? .??>???????????e????$??8????????????????z??<???????????????????a????????????????~??<???e???????e????N??K????????D?????????????Root\*6TO4MP\0002???Root\*6TO4MP\0003???NDIS?2??? ???v???f???????????????>??????p????8???8??Universal Serial Bus controllers?ll,-3025???%systemroot%\system32\setupapi.dll,-20??????.NT??????8??????????????????????????}\???8??usb.inf?????@%SystemRoot%\System32\SysClass.Dll,-3025????????(??????????????????????????????????? ???8??????????????6-2
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanServer\Linkage@Route                                                                                                    ????????\SystemRoot\system32\drivers\hidusb.sys?????????????????????????????????????????? ??iv????????????????????????????????????>???????????????p????????g????@%SystemRoot%\system32\clfs.sys,-101????? ???????~????????????L??????????????????????_?????sCI??????????????????????????????????????????????????????????? z???????????????????N????????????????n??????4???????????h??????????????\??nd??????????{8ed9d8e3-885a-5802-98e4-4c19cc18eb23}????????????????????????????8??????????????????????6??????? ??????????????????????????????????$???????????????????????????????????????????????????????????????????? ??????????????? ??????????????????????????????????$???????????????????????????????????????????????????????????????????????????????????? ????????????????????????H?????????$??????????????????????????????????????n????@%SystemRoot%\system32\powrprof.dll,-119,Sleep transition settings??????????????????????????@%SystemRoot%\system32\powrprof.dll,-120,Sleep transition settings?????????????????????n????????????????? ?????????
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanServer\Linkage@Export                                                                                                   ???h????? ???`?????????p6"??????????????????????? ???v?????????7????Network??????????????,??????c0??? ???(??????????????{00000000-0000-0000-ffff-ffffffffffff}??????? ???<???s??????????mrxsmb??????????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ???????????????????????????WDC WD5000BEVT-35A0RT0??????? ???>??????????????????????????????_I??\Driver\ACPI_HAL?????$???g????????????????????????????X??h??? ??????? &??Y???E?????owA???????K??????????????????????????????{4d36e96b-e325-11ce-bfc1-08002be10318}??? ???????????-???e??? ???<??????????Ty????N??w?????????D??????<??u????????????????J??h?????????e?????????K??????????????\Device\Smb_Tcpip_{5A4CBE0B-3EBC-4FCC-97BC-D3EB0D869B1A}?\Device\Smb_Tcpip_{D89F9632-072D-4FF8-9106-16BB537DFBCD}?\Device\Smb_Tcpip_{C4D56BA7-546F-4028-B0A9-781F6BED8ACD}?\Device\Smb_Tcpip_{7EB5C97F-4C99-4153-988A-05343187C4F8}?\Device\Smb_Tcpip_{7AF6408E-F56F-4541-983C-72C29EB0AEE2}?\Device\Smb_Tcpip_{1FADB770-59EE-4A2F-8BB0-8D48CABA506E}?\Device\Smb_T
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage@Bind                                                                                                ???????????????????????s????????????????0????d?????????ium???????????r????rAPI??????????????????????? (??????o???????~????b????????????n??????h?????? ?g?5???????w???o??ig???????"??????????{36fc9e60-c465-11cf-8056-444553540000}\0012?ej??????????{4d36e96c-e325-11ce-bfc1-08002be10318}??US???K?K?g?h?u?u???????v????????????????0????????????A????????????????????????????(??????}??????ACPI\Processor??????????????????? ???????????:????????t??3??????????????????Microsoft????????????????????????????????????????????s??????????????????????????????system32\DRIVERS\kl1.sys????????????????88??????????????????????????????????USB\Class_0e&SubClass_03&Prot_00?USB\Class_0e&SubClass_03?USB\Class_0e????????>????????g??????*????????????????n?????????????-??a0??????88???? ??????u???????????1??????????{36fc9e60-c465-11cf-8056-444553540000}???????????????????????????????a??.i??????0????3?????A???????????????????????g??????????????????????p????????g????@%systemroot%\system32\drivers\afd.sys,-1000????????????????????????????????????1??
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage@Route                                                                                               ????s?????(??????i??????.NTAMD64?????????????^?^ns??? ????????????????????????????????????????8???????????h???????`????????????e?????????????? ??8??????p???????????192.168.1.1??????????????????????n???????z???3??????????????????????ISO9660/Joliet File System Reader for CD/DVDs. (Core) (All pieces)??????????????Sterownik Microsoft klasy HID????????????0???????????????3???3??system32\DRIVERS\btwavdt.sys?????????<??????????????????????????????????????????? ??????????????s?????????????<????????????$??????P????????????n?????????????i??????????????@%systemroot%\system32\drivers\dfsc.sys,-101??????????????????????"???????????????????????????????????????????????R???????????h??????????????t???????????????????????????????5?????????????g????????????????????Nokia 6303i classic?mtp.devicedesc%;Urz?dzenie MTP USB?? ???Port_#0005.Hub_#0004????????????????????????????????????t?????>??????????????????????????m??? ????????????????????????????????????????????????$??????3???3???????????0???????????????????????????z?????????????
Reg       HKLM\SYSTEM\ControlSet001\services\LanmanWorkstation\Linkage@Export                                                                                              ????????? ???????e????????????????????????????X??????????????????????s??t????r?r?s?r?????t???????????z??????BTHMODEM????@%SystemRoot%\system32\powrprof.dll,-12,System performance is more important than longer battery life.??????@%SystemRoot%\system32\powrprof.dll,-13,High Performance????????????????????????????????????????????????? ????????????????????????????????????2????????????????????n????@%SystemRoot%\system32\powrprof.dll,-14,Windows automatically balances power savings and system performance, offering full performance on demand, and saving power when idle.???????????????????????????@%SystemRoot%\system32\powrprof.dll,-15,Automatic (recommended)?????????????????????????????????????????0???1???2???????? ????????????????????????H?????????????????????????? ??????????????????????????????????$???????????????????????????????????????????????????????????????? ??????????????????????????????????$????????????????????????????????????????????????????????????????????????????????????????????????????????????h???????e?
Reg       HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\4cedde049834 (not active ControlSet)                                                                  
Reg       HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\4cedde049834@1814569234d9                                                                             0xEF 0x38 0x09 0xEB ...
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanServer\Linkage@Bind                                                                                                     ????????????????????? ?????????????????????z????????\???&???????????????????????? ??????????????????????????????????$?????????????????????`?????????????????????????????????????????????????????????????????????? ?????????????????????z??L??????????????4??? ?????????????????????z????????D???&????????????????????3??? D??????-??????eE??Teredo Tunneling Pseudo-Interface????????????6??????06??????????? ?????????????????????z????????????????????????????????????????? ??????????????????????????????V????????V??????????????t?????????????????????????????????????????????????R???????????h?????\SystemRoot\system32\DRIVERS\IPMIDrv.sys??????????????????V??????????????d??ipmidrv.inf_amd64_neutral_183d6cac9a33faff??????? ??????????????????????????????<???????T?????<????????????e????IP Network Address Translator?????6?????????????????System32\drivers\ipnat.sys???????????????????????????????????????????????????????????????????????????????????????e??Tcpip???????????????????????? ??????????????????????????????^?????????????^????????
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanServer\Linkage@Route                                                                                                    ????????????? ????????????????????????????????????????????s4.s????????(?????????????????????LocalSystem???????????????????,???????????????????????????????????????0?????????????????????s???? ??????????????????????????????:????????gx?? ??????????????????????????????????$???????????????????\K????????????????????s?????????????????????????????????????? ????????????????????????????????????????(??????????0??????????????????????????????????????? ??????????????????????????????R????????k???????????????????????n????2??????????????????????????????9?????????t?:???????????????????????????????????????o???????????????n???????????????????????????c??????????????????????????????????????????????????????????? ????????????????????????????@?????????m???SeBackupPrivilege?SeChangeNotifyPrivilege?SeCreateGlobalPrivilege?SeCreatePermanentPrivilege?SeImpersonatePrivilege?SeManageVolumePrivilege?SeRestorePrivilege?SeIncreaseBasePriorityPrivilege?SeManageVolumePrivilege?SeRestorePrivilege?SeTcbPrivilege????enum????????????????????SeChang
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanServer\Linkage@Export                                                                                                   ????????????????????????????? ??????????????????????????????R????????k???????????????????????n????2??????????????????????????????9?????????t?:???????????????????????????????????????o???????????????n???????????????????????????c??????????????????????????????????????????????????????????? ????????????????????????????@?????????m???SeBackupPrivilege?SeChangeNotifyPrivilege?SeCreateGlobalPrivilege?SeCreatePermanentPrivilege?SeImpersonatePrivilege?SeManageVolumePrivilege?SeRestorePrivilege?SeIncreaseBasePriorityPrivilege?SeManageVolumePrivilege?SeRestorePrivilege?SeTcbPrivilege????enum????????????????????SeChangeNotifyPrivilege?SeCreateGlobalPrivilege?SeImpersonatePrivilege??????????????????????????????@%SystemRoot%\System32\swprv.dll,-103???????? F???????????????????X???????????h?????%SystemRoot%\system32\svchost.exe -k imgsvc?????????????????????? ????????????????????????????,?F??? ???????????%systemroot%\system32\msdtckrm.dll????????"????????????n????KtmRmServiceMain????????????????????????????? ?????????????????
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanWorkstation\Linkage@Bind                                                                                                ???????????? ?????????????x???????????`?? ?????????????????????????????????????m????t????????????:???:?????????????????e????Samsung-R780?TI??????????&???????????????????s??ep??????????????t0??????????????????LanmanServer_NetBT_Tcpip_{7EB5C97F-4C99-4153-988A-05343187C4F8}?\Device\LanmanServer_NetBT_Tcpip_{3B83E5D9-454C-444F-A253-83691B67C95F}?\Device\LanmanServer_NetBT_Tcpip_{7AF6408E-F56F-4541-983C-72C29EB0AEE2}?\Device\LanmanServer_NetBT_Tcpip_{507A3029-69D3-4083-83A6-44F88F9ED2E6}?\Device\LanmanServer_NetBT_Tcpip_{1FADB770-59EE-4A2F-8BB0-8D48CABA506E}?\Device\LanmanServer_NetBT_Tcpip6_{8C92DD30-544A-4F2B-82C8-D6FCFCB51185}?\Device\LanmanServer_NetBT_Tcpip6_{909A8536-120E-4EDD-873C-B7409745961D}?\Device\LanmanServer_NetBT_Tcpip6_{2B3F72D4-C303-4FFF-A81A-A20E81EA95D2}?\Device\LanmanServer_NetBT_Tcpip6_{989D0818-6D41-4A28-A688-86331F015C60}?\Device\LanmanServer_NetBT_Tcpip6_{83E8373C-B5EB-46DA-9163-0757B78CC1BB}?\Device\LanmanServer_NetBT_Tcpip6_{D16089A6-A934-4391-A119-359DCB6A220F}?\Device\LanmanServer_NetB
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanWorkstation\Linkage@Route                                                                                               ????????????t0??????????????????LanmanServer_NetBT_Tcpip_{7EB5C97F-4C99-4153-988A-05343187C4F8}?\Device\LanmanServer_NetBT_Tcpip_{3B83E5D9-454C-444F-A253-83691B67C95F}?\Device\LanmanServer_NetBT_Tcpip_{7AF6408E-F56F-4541-983C-72C29EB0AEE2}?\Device\LanmanServer_NetBT_Tcpip_{507A3029-69D3-4083-83A6-44F88F9ED2E6}?\Device\LanmanServer_NetBT_Tcpip_{1FADB770-59EE-4A2F-8BB0-8D48CABA506E}?\Device\LanmanServer_NetBT_Tcpip6_{8C92DD30-544A-4F2B-82C8-D6FCFCB51185}?\Device\LanmanServer_NetBT_Tcpip6_{909A8536-120E-4EDD-873C-B7409745961D}?\Device\LanmanServer_NetBT_Tcpip6_{2B3F72D4-C303-4FFF-A81A-A20E81EA95D2}?\Device\LanmanServer_NetBT_Tcpip6_{989D0818-6D41-4A28-A688-86331F015C60}?\Device\LanmanServer_NetBT_Tcpip6_{83E8373C-B5EB-46DA-9163-0757B78CC1BB}?\Device\LanmanServer_NetBT_Tcpip6_{D16089A6-A934-4391-A119-359DCB6A220F}?\Device\LanmanServer_NetBT_Tcpip6_{33EFEF18-C7C7-4928-B531-70299FD042FA}?\Device\LanmanServer_NetBT_Tcpip6_{E60A1BF7-C88D-49F3-A435-C964E2DCAC1A}?\Device\LanmanServer_NetBT_Tcpip6_{DBFB95A1-5968-463C-B
Reg       HKLM\SYSTEM\ControlSet003\services\LanmanWorkstation\Linkage@Export                                                                                              ????????????%systemroot%\system32\svchost.exe -k LocalSystemNetworkRestricted????????????????0??????rpcss?fileinfo??????? ????????????????????N????????????e??????????????????????????????,???????????????????????????????????????????????????h???????????????????????????T????????????e????????????????????????????????????????????????????????????????????????????????????????????????????????enum????? ???????????????????????????????????????e???????????????????e??RpcSs?winmgmt???????????????? ??????????????????????????????N????????????r??? 2?????????????????\Device\LanmanRedirector??????4?????????????Microsoft Windows Network?????????????N????????????e????@%systemroot%\system32\wkssvc.dll,-102????????F?????????????????%SystemRoot%\System32\ntlanman.dll??????????????????????????????? ????????????????????????????0?B??? ???????????? B?????????????????%SystemRoot%\System32\wkssvc.dll?????????????????????????????????????????????????d???????????????????????e??????????????????????????????????????????????????????ms?????????????
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde049834                                                                                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde049834@1814569234d9                                                                         0xEF 0x38 0x09 0xEB ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Bind                                                                                                 ????????????????????????????????????????????????Net?Te???+?+? ?+HD?????1???/?????.?.?S??????????????????????????????RPCSS???????Intel Processor Driver????????????????????????4?????????????????????????????p???Huawei DataCard USB Modem and USB Serial????? ???????n???????n??NativeWiFi Filter???????????????????oem31.inf????;?;???????%???%????? ????????N??????C????DDri??r???????????????????????????system32\DRIVERS\mrxsmb.sys?????????????????????system32\DRIVERS\SynTP.sys??????? ???????T???????.???????????M??el??????????????????????????????t???????????????????SCSI Miniport????????????n?????r?n??????r???????????????t????????????????????????e??????????????????????????????Net?\D??? V??'???????????????????????5?5tm???4?4?????????&?&????BTAUDIO?????????????@%systemroot%\system32\drivers\hwpolicy.sys,-102????????????????????.NT??&?????????????????????????????????????r???????????????g????Synaptics TouchPad Driver???????????????????Pointer Port????????????????????????????????????????????????????????? ??????????????p??????
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Route                                                                                                ??? ? ???$??? ???????????????????????????????????????????????????????????????????/?/1?????X??.???????2???????????1??????FB??? ???????1?????-10??????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????????????????????????3?3??????<?????? ?g????oem16.inf???????????????????????? b?????????????????btwaudio.sys?4??????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????????????????????$??? ????????????????????????????????????????????? ????? ???????P?????|LP??????????RE??? b?????????????r???????????????????????????????????? ???????????????$??? ??????????????????????????????? ???$???????????????????????????????$??????????????????????????????? `??????0??????sb??????$???4????? ??????? ??????????????? ????????????????????????????????????????? ??????????? ????????????????????????????????????????????????????????????????????????????$??? ??????????????????????????? ??0????n?????n?n??????????????????????????????Broadcom? ?????
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanServer\Linkage@Export                                                                                               ??? ? ????2?? ??????????????????SeChangeNotifyPrivilege?????????????????????????????????????? ? ? ? ? ? ? ? ????????? ????????h?????%SystemRoot%\System32\svchost.exe -k LocalSystemNetworkRestricted?????R?? ?????????n????@%SystemRoot%\System32\audiosrv.dll,-205????? ??? ??????????????LocalSystem?????????????????t??????????????????????????? ?????????????,?? ???????????????????????????????e????????????????????????R?? ?????????e????? ????2?? ??????????????????SeChangeNotifyPrivilege?????????????????????????????????? ? ? ? ? ? ? ? ? ? -0??@%SystemRoot%\system32\audiosrv.dll,-200????????? ??????p???AudioGroup??????????? ????????h?????%SystemRoot%\System32\svchost.exe -k LocalServiceNetworkRestricted????????R?? ?????????n????@%SystemRoot%\System32\audiosrv.dll,-201????? 4?? ??????????????NT AUTHORITY\LocalService???????????????t??????????????????????????? ?????????????,?? ????????????????D?? ???????????e??AudioEndpointBuilder?RpcSs?MMCSS??????????????????????????R?? ?????????e????? ??????? ??????????????????SeChang
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Bind                                                                                            ????? ??? ??????????????????????????????????????? ? ? ? ? ? ? ? ? ? ? ???????????0????????????J?? ?????????e????@%systemroot%\system32\eapsvc.dll,-1??????Z?? ????????h?????%SystemRoot%\System32\svchost.exe -k netsvcs??????J?? ?????????n????@%systemroot%\system32\eapsvc.dll,-2????? ??????????????????????????????????????LocalSystem????????? ???????????????? ???????????e??RPCSS?KeyIso??????,?? ????????????????????????????????????p?? ??????????????????SeTcbPrivilege?SeDebugPrivilege?SeImpersonatePrivilege??????? ? ? ? ? ? ? ? ? ? ? ????????????????????????????N?? ?????????e????@%SystemRoot%\system32\efssvc.dll,-100????????@?? ????????h?????%SystemRoot%\System32\lsass.exe???????N?? ?????????n????@%SystemRoot%\system32\efssvc.dll,-101??????? ??? ??????????????????????????????????????????????t??????????????????????? ????????????????????????????e??? ? ? ? ? ? ? ? ? ??????? ??????????????????SeImpersonatePrivilege?SeTcbPrivilege?SeIncreaseQuotaPrivilege?SeAssignPrimaryTokenPrivilege?SeAuditPrivilege??????????????????
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Route                                                                                           ????g???????????????????? ??H???????????? ??6.1.7601.17514??????????????????btwl2cap?f??????? ???s??ep???M?N????? |??????????????????????????????0???????????????????????h?????????????&???&????????????????????????????????????p???????????????????????9-28-2009???? ??RPCSS????????????????S??????_\???|????????????N????????????e????@%systemroot%\system32\wkssvc.dll,-100???????? ?????????p???NetworkProvider???????h???????????h?????%SystemRoot%\System32\svchost.exe -k NetworkService???????N????????????n????@%systemroot%\system32\wkssvc.dll,-101??????? 8?????????????????NT AUTHORITY\NetworkService?????????????????????????????????????p???????????????t??????? ?????????????,???????????????????<??????????????e??Bowser?MRxSmb10?MRxSmb20?NSI????????????????????????????????????t???????????????????????????????????SeChangeNotifyPrivilege?SeImpersonatePrivilege?SeAuditPrivilege?????????????????????????????????????????????????????nu????L????????????e????@%SystemRoot%\system32\lltdres.dll,-1?????d???????????h?????%SystemRoot%\Sy
Reg       HKLM\SYSTEM\CurrentControlSet\services\LanmanWorkstation\Linkage@Export                                                                                          ?????????????????h?????????????&???&????????????????????????????????????p???????????????????????9-28-2009???? ??RPCSS????????????????S??????_\???|????????????N????????????e????@%systemroot%\system32\wkssvc.dll,-100???????? ?????????p???NetworkProvider???????h???????????h?????%SystemRoot%\System32\svchost.exe -k NetworkService???????N????????????n????@%systemroot%\system32\wkssvc.dll,-101??????? 8?????????????????NT AUTHORITY\NetworkService?????????????????????????????????????p???????????????t??????? ?????????????,???????????????????<??????????????e??Bowser?MRxSmb10?MRxSmb20?NSI????????????????????????????????????t???????????????????????????????????SeChangeNotifyPrivilege?SeImpersonatePrivilege?SeAuditPrivilege?????????????????????????????????????????????????????nu????L????????????e????@%SystemRoot%\system32\lltdres.dll,-1?????d???????????h?????%SystemRoot%\System32\svchost.exe -k LocalService?????L????????????n????@%SystemRoot%\system32\lltdres.dll,-2???? 4?????????????????NT AUTHORITY\LocalService??????????

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                                            unknown MBR code

---- EOF - GMER 2.1 ----