GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2016-12-27 22:07:12
Windows 6.2.9200  x64 \Device\Harddisk0\DR0 -> \Device\0000002d GOODRAM rev.SAFM22.3 223,57GB
Running: rmq2tm48.exe; Driver: F:\TEMP\fwlcqpow.sys


---- Threads - GMER 2.2 ----

Thread  C:\Windows\system32\csrss.exe [1540:4852]                                                                                                  ffffa1eb87b76c20

---- Registry - GMER 2.2 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Control\BackupRestore\FilesNotToSnapshot@OfficeODC                                                           ???|????? ???????{??????????????????????????????????? ???????{????????????????????R?P?????0???????.????????????????????{?????)J??{???{????????????????????0?N???Microsoft Audio Home Theater Effects? ???(N??{???A??????????????????????{62dc1a93-ae24-464c-a43e-452f824c4250}????????<??????????????????Y??Windows_NT?y 2???????????t??pi????l??????n???T???????|???|??????????????????????? ??????????????????????????????@???,???????????????????????????????????????????????????????????????? ??????????????????????????????P???,???????????????????????.d????P??{??????????????????????????????????????????????????? ??????????????????????????????@???,?????????????????????????????@??{???????????????????????????????????????????????|????????P??|????????@??|????????@??????????(N??{???I??????????????????????{637c490d-eee3-4c0a-973f-371958802da2}????????.?????????????3????????????{???{??A?(??????????????????????????(???????0??????????????????????? ????????????????????????????P?N????????????(N??????????????????????????????(N??{???.?????
Reg     HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime                                                                          0xE9 0x4E 0x28 0x71 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime                                                                      0x22 0x16 0xEF 0x24 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime                                                                             0xE9 0x4E 0x28 0x71 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime                                                                         0x22 0x16 0xEF 0x24 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@pl-PL                                                                      85
Reg     HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM000116843009_01_07E0_9F^EA18EE06D3D42E38ED1642DF927377B0@Timestamp  0xAF 0xE3 0x41 0x76 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid                                                                                           1688
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber                                                         2795729
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\kernel\RNG@RNGAuxiliarySeed                                                          1239345160
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId                                          85
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime                                        492736619
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime                                                                       9449
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime                                                                     9360
Reg     HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID                                                                           14f8e8af-4f7e-418e-8771-e9a364d
Reg     HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter                                                             1
Reg     HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0019860000ba                                                                
Reg     HKLM\SYSTEM\CurrentControlSet\Services\bthserv\Parameters\BluetoothControlPanelTasks@State                                                 0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{5f7f4f45-16fb-4655-86e9-9982f1b7581e}@LastProbeTime                      1482873110
Reg     HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\RxDeliveryStamp                                                                     
Reg     HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\RxDeliveryStamp\{57C7DD3D-2E9C-4F3B-A270-391E8AEDF0C4}                              
Reg     HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\RxDeliveryStamp\{57C7DD3D-2E9C-4F3B-A270-391E8AEDF0C4}\Parameter                    
Reg     HKLM\SYSTEM\CurrentControlSet\Services\EventLog\System\RxDeliveryStamp\{57C7DD3D-2E9C-4F3B-A270-391E8AEDF0C4}\Parameter@DataA              0x01 0x17 0x43 0x66 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc\Parameters\Isatap\{E102E45E-83CC-4EC1-9B73-CA5EA119598C}@DefunctTimestamp                  0x06 0xCB 0x62 0x58 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch                                                                            2543
Reg     HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch                                                                           198
Reg     HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence                                                                     84
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae929255-bede-4059-aad1-b04a9f4fafb2}@LeaseObtainedTime                1482869510
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae929255-bede-4059-aad1-b04a9f4fafb2}@T1                               1483171910
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae929255-bede-4059-aad1-b04a9f4fafb2}@T2                               1483398710
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{ae929255-bede-4059-aad1-b04a9f4fafb2}@LeaseTerminatesTime              1483474310
Reg     HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeEstimated                                                        0x58 0x8B 0x6A 0xA8 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeHigh                                                             0x58 0xF3 0x2E 0x0A ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\W32Time\SecureTimeLimits@SecureTimeLow                                                              0x58 0x23 0xA6 0x46 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop                                                           0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Object List                                                                    24038 24044 24054 24064 24084 24128 24138 24176 24182 24198
Reg     HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Counter                                                                   24204
Reg     HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@Last Help                                                                      24205
Reg     HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Counter                                                                  24038
Reg     HKLM\SYSTEM\CurrentControlSet\Services\WmiApRpl\Performance@First Help                                                                     24039
Reg     HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{AE7CD045-E861-484F-8273-0445EE161910}\iexplore@Count                             2
Reg     HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF}\iexplore@Count                             2
Reg     HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest                                     0xC6 0x38 0xAA 0x29 ...

---- Disk sectors - GMER 2.2 ----

Disk    \Device\Harddisk0\DR0                                                                                                                      unknown MBR code

---- EOF - GMER 2.2 ----