GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-05-06 22:41:31 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-4 SAMSUNG_HD502IJ rev.1AA01113 465,76GB Running: l5sggss3.exe; Driver: C:\Users\Dawid\AppData\Local\Temp\awddikob.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[1908] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072581a22 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1908] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072581ad0 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1908] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072581b08 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1908] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072581bba 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1908] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072581bda 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072581a22 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072581ad0 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072581b08 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072581bba 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072581bda 2 bytes [58, 72] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074ed1465 2 bytes [ED, 74] .text C:\Windows\SysWOW64\PnkBstrB.exe[1928] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074ed14bb 2 bytes [ED, 74] .text ... * 2 .text D:\Programy\Spybot - Search & Destroy 2\SDFSSvc.exe[1328] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000074ed1465 2 bytes [ED, 74] .text D:\Programy\Spybot - Search & Destroy 2\SDFSSvc.exe[1328] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000074ed14bb 2 bytes [ED, 74] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\ProgramData\GG\ggdrive\ggdrive-overlay.dll (*** suspicious ***) @ C:\Windows\Explorer.EXE [1516] (GG drive overlay/GG Network S.A.)(2013-08-01 08:21:48) 000000005c080000 ---- Files - GMER 2.1 ---- File C:\Users\Dawid\AppData\Local\Temp\tmp7B09.tmp 0 bytes ---- EOF - GMER 2.1 ----