GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-01-01 08:57:13
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\00000058 ST332041 rev.CC38 298,09GB
Running: gmer.exe; Driver: C:\Users\Scrop\AppData\Local\Temp\pwddykod.sys


---- User code sections - GMER 2.2 ----

.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000751c1401 2 bytes JMP 763beb26 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000751c1419 2 bytes JMP 763cb513 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000751c1431 2 bytes JMP 76448609 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000751c144a 2 bytes CALL 763a1dfa C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                        * 9
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000751c14dd 2 bytes JMP 76447efe C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000751c14f5 2 bytes JMP 764480d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000751c150d 2 bytes JMP 76447df4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000751c1525 2 bytes JMP 764481c2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000751c153d 2 bytes JMP 763bf088 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000751c1555 2 bytes JMP 763cb885 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000751c156d 2 bytes JMP 764486c1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000751c1585 2 bytes JMP 76448222 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000751c159d 2 bytes JMP 76447db8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000751c15b5 2 bytes JMP 763bf121 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000751c15cd 2 bytes JMP 763cb29f C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000751c16b2 2 bytes JMP 76448584 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files\Malwarebytes\Anti-Malware\mbamtray.exe[2384] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000751c16bd 2 bytes JMP 76447d4d C:\Windows\syswow64\kernel32.dll

---- EOF - GMER 2.2 ----