GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2016-11-19 16:40:12
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000003c ST1000LM014-SSHD-8GB rev.LVD3 931,51GB
Running: dfqbn1u1.exe; Driver: C:\Users\PAWE~1\AppData\Local\Temp\kxldrpow.sys


---- Threads - GMER 2.2 ----

Thread   C:\WINDOWS\system32\csrss.exe [760:920]                                                                                                                 ffffc42555a16c20

---- Services - GMER 2.2 ----

Service  C:\WINDOWS\System32\drivers\L1C63x64.sys (*** hidden *** )                                                                                              [MANUAL] L1C                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                      <-- ROOTKIT !!!

---- Registry - GMER 2.2 ----

Reg      HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot@OfficeODC                                                                        ?????????????????????????r???3???????????????????? ???????????????????????????????????????????????? ??? ???%???%???%???%???%???%???%???%???(???(???(???(???(???(???(???)???)???)???)???)?:?)???)???)???)???)???)???)???)???)???)???)???)???)???)???*???+???+???+???+???+???-???-???.???.???1???=???=???=???A???B???B???B???B???B???C???C???C???C???C???C???D???D???D???D???H?A?H???H???H???H???H???H???H???H???H???H???H???I???I?C?I???I???I???I???I???I???I???I???I???I???I???I???I???O???O???O????? ??????????????????????????????N??????????? ?????N??????????e??%SystemRoot%\system32\AppReadiness.dll??????? ????????????????????????"?????????????????? ????????????????????????$????????? ???????e???? ????????????????????????????L???????????????????b??????`?W?`??%SystemRoot%\system32\LogFiles\WMI\RtBackup\*.*?????????????????????????????????????????????????????????????????????????????????\System Volume Information\FVE2.{e40ad34d-dae9-4bc7-95bd-b16218c10f72}.*????????????????????\System Volume Information\FVE2.{c9ca54a3-6983-46b7-868
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{55E58BFD-4F5A-472B-A9C1-5FC8D521D9F1}\Connection@Name             Reusable ISATAP Interface {55E58BFD-4F5A-472B-A9C1-5FC8D521D9F1}
Reg      HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed                                                                       1237230250
Reg      HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14734119416252280@SetupOperations                                                      ???g?????g?h?h?h?h???????????????????????????s??????????????????????????????????? ???????g???????????g???????? ??????????????????????????g???-??Reverted?<???g?g?g?g?g?g?g?g?????????????????????????????????6?????t36???????g??????????????????xt???????g?????????????????g?????i?i?i?i?j?j?????????????????????????????s??????????????????4???????????????? ???????g???????????g???????? ??? ??????????????????????g??????Commited?????g?g?g?g?g?g?????????????4?????t???????????????????t?????????g???c??????????????C:???????????I???????????????s???2??????????? ???????f?????g?????g??????????P?6?????? ???????g???T?????e E??aswSnx???(???g?g?g?g?g?g?g?g??????L??g??????????????avast! virtualization driver (aswSnx)????????????D??pl???????????x??t1????????????????????????P??g????????h?????\SystemRoot\system32\drivers\aswSnx.sys?ys????????0??g??????p???FSFilter Virtualization??????????g???????????e??FltMgr??????? ???????g?????g?????g?)???????? ????????????????? ??g??????????????aswSnx Instance????????g???g????? ???????g???????????g?
Reg      HKLM\SYSTEM\CurrentControlSet\Services\aswRvrt\Parameters\Instup_14734119913432280@SetupOperations                                                      ???g?????i?i?i?i?j?j?????????????????????????????s??????????????????4???????????????? ???????g???????????g???????? ??? ??????????????????????g??????Commited?????g?g?g?g?g?g?????????????4?????t???????????????????t?????????g???c??????????????C:???????????I???????????????s???2??????????? ???????f?????g?????g??????????P?6?????? ???????g???T?????e E??aswSnx???(???g?g?g?g?g?g?g?g??????L??g??????????????avast! virtualization driver (aswSnx)????????????D??pl???????????x??t1????????????????????????P??g????????h?????\SystemRoot\system32\drivers\aswSnx.sys?ys????????0??g??????p???FSFilter Virtualization??????????g???????????e??FltMgr??????? ???????g?????g?????g?)???????? ????????????????? ??g??????????????aswSnx Instance????????g???g????? ???????g???????????g?)?????????????????????????????g??????????137600??? ???g?g???????????????????????g????? ???????g???????????g?)????????T??? ???????????? T??g???0??????r0??\??\C:\Program Files\AVAST Software\Avast????g?g????? P??g???????????(??\??\C:\ProgramData\AVAST Software\Avast
Reg      HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00c2c660957c                                                                             
Reg      HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00c2c660957c@78f8826ef069                                                                0x8B 0x38 0x98 0x77 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00c2c660957c@f4cb526e6baf                                                                0x78 0xCC 0xF6 0x5F ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00c2c660957c@3234567a5987                                                                0xEB 0x79 0x78 0x16 ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{55E58BFD-4F5A-472B-A9C1-5FC8D521D9F1}@InterfaceName                                  Reusable ISATAP Interface {55E58BFD-4F5A-472B-A9C1-5FC8D521D9F1}
Reg      HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{55E58BFD-4F5A-472B-A9C1-5FC8D521D9F1}@ReusableType                                   2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                                         14527
Reg      HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                                        2775
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34ccabc5-5a86-4a57-96ed-7a202b88d49f}@LeaseObtainedTime                             1479556661
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34ccabc5-5a86-4a57-96ed-7a202b88d49f}@T1                                            1479599861
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34ccabc5-5a86-4a57-96ed-7a202b88d49f}@T2                                            1479632261
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{34ccabc5-5a86-4a57-96ed-7a202b88d49f}@LeaseTerminatesTime                           1479643061
Reg      HKLM\SYSTEM\CurrentControlSet\Services\Tcpip6\Parameters\Interfaces\{34ccabc5-5a86-4a57-96ed-7a202b88d49f}@Dhcpv6State                                  2
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated                                                                     0x8A 0xE2 0x7A 0x1A ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh                                                                          0x8A 0x4A 0x3F 0x7C ...
Reg      HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow                                                                           0x8A 0x7A 0xB6 0xB8 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw                                                                                                      0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask                                                                                                  0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@Rw                                                                                                      0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\1@RwMask                                                                                                  0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@Rw                                                                                                      0x64 0x62 0x03 0x00 ...
Reg      HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\2@RwMask                                                                                                  0x64 0x62 0x03 0x00 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime                                                0xDA 0xE3 0x48 0x06 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime                                           0xDA 0xE3 0x48 0x06 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime                                                  0xDA 0xE3 0x48 0x06 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime                                                 0xDA 0xE3 0x48 0x06 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken                                                                 LM%3d63615075290980%3bID%3dA73D6A09E5F32413!104%3bLR%3d63615153417893%3bEP%3d13%3bSI%3d62%3bTD%3dTrue%3bSO%3d0%3bPI%3d49
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                                  0x4A 0xC9 0x49 0xB9 ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search@JumpListChangedAppIds                                                                             E7CF176E110C211B?windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel?
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@E7CF176E110C211B                                                                     0x54 0xC5 0x86 0x6C ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Search\JumplistData@windows.immersivecontrolpanel_cw5n1h2txyewy!microsoft.windows.immersivecontrolpanel  0xB4 0xBC 0x28 0x6F ...
Reg      HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\SettingSync\SyncData@PendingOperations                                                                   13

---- EOF - GMER 2.2 ----