GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-05-31 00:03:36
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD322HJ rev.1AG01113 298,09GB
Running: gmer.exe; Driver: C:\Users\ARTUR1~1\AppData\Local\Temp\kwryipow.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter  0000000074c08769 4 bytes [C2, 04, 00, 00]
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17       0000000076051401 2 bytes JMP 74c2b1ef C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17         0000000076051419 2 bytes JMP 74c2b31a C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17       0000000076051431 2 bytes JMP 74ca8f09 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42       000000007605144a 2 bytes CALL 74c04885 C:\Windows\syswow64\kernel32.dll
.text   ...                                                                                                                         * 9
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17          00000000760514dd 2 bytes JMP 74ca8802 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17   00000000760514f5 2 bytes JMP 74ca89d8 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17          000000007605150d 2 bytes JMP 74ca86f8 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17   0000000076051525 2 bytes JMP 74ca8ac2 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17         000000007605153d 2 bytes JMP 74c1fc78 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17              0000000076051555 2 bytes JMP 74c268bf C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17       000000007605156d 2 bytes JMP 74ca8fc1 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17         0000000076051585 2 bytes JMP 74ca8b22 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17            000000007605159d 2 bytes JMP 74ca86bc C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17         00000000760515b5 2 bytes JMP 74c1fd11 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17       00000000760515cd 2 bytes JMP 74c2b2b0 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20   00000000760516b2 2 bytes JMP 74ca8e84 C:\Windows\syswow64\kernel32.dll
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1464] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31   00000000760516bd 2 bytes JMP 74ca8651 C:\Windows\syswow64\kernel32.dll

---- Threads - GMER 2.1 ----

Thread  C:\Windows\System32\svchost.exe [2092:2584]                                                                                 000007fef3669688
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:3472]                                                      0000000074ab7587
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:3564]                                                      0000000072bd758a
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:1496]                                                      00000000770713b5
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:3820]                                                      00000000770827e5
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:2072]                                                      00000000770827e5
Thread  C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2020:1716]                                                      00000000770827e5

---- EOF - GMER 2.1 ----