GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2016-02-23 00:04:42
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4 ST9250320AS rev.0303 232,89GB
Running: pwkygvv2.exe; Driver: C:\Users\Zigi\AppData\Local\Temp\aftciaoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification

---- User code sections - GMER 2.1 ----

.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter  0000000075b0d03c 4 bytes [C2, 04, 00, 00]
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17       0000000076571401 2 bytes JMP 75b1eb26 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17         0000000076571419 2 bytes JMP 75b2b513 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17       0000000076571431 2 bytes JMP 75ba8609 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42       000000007657144a 2 bytes CALL 75b01dfa C:\Windows\syswow64\kernel32.dll
.text     ...                                                                                                                        * 9
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17          00000000765714dd 2 bytes JMP 75ba7efe C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17   00000000765714f5 2 bytes JMP 75ba80d8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17          000000007657150d 2 bytes JMP 75ba7df4 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17   0000000076571525 2 bytes JMP 75ba81c2 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17         000000007657153d 2 bytes JMP 75b1f088 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17              0000000076571555 2 bytes JMP 75b2b885 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17       000000007657156d 2 bytes JMP 75ba86c1 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17         0000000076571585 2 bytes JMP 75ba8222 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17            000000007657159d 2 bytes JMP 75ba7db8 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17         00000000765715b5 2 bytes JMP 75b1f121 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17       00000000765715cd 2 bytes JMP 75b2b29f C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20   00000000765716b2 2 bytes JMP 75ba8584 C:\Windows\syswow64\kernel32.dll
.text     C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1632] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31   00000000765716bd 2 bytes JMP 75ba7d4d C:\Windows\syswow64\kernel32.dll

---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification
INITKDBG  C:\Windows\system32\ntoskrnl.exe                                                                                           suspicious modification

---- Threads - GMER 2.1 ----

Thread    C:\Windows\System32\svchost.exe [2292:1304]                                                                                000007fef19e9688
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [2524:892]                                                              000007fefbc32a74
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [2524:900]                                                              000007fef22ddc08
Thread    C:\Program Files\Windows Media Player\wmpnetwk.exe [2524:2300]                                                             000007fef93e5124

---- EOF - GMER 2.1 ----