GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-01-19 13:48:09
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 298,09GB
Running: gmer.exe; Driver: C:\Users\Agata\AppData\Local\Temp\fwddakog.sys


---- Kernel code sections - GMER 2.2 ----

.text  C:\Windows\System32\win32k.sys!W32pServiceTable                                                                             fffff96000125900 7 bytes [40, 4C, F3, FF, 01, 56, F0]
.text  C:\Windows\System32\win32k.sys!W32pServiceTable + 8                                                                         fffff96000125908 3 bytes [C0, 06, 02]

---- User code sections - GMER 2.2 ----

.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000076801401 2 bytes JMP 766fb233 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000076801419 2 bytes JMP 766fb35e C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000076801431 2 bytes JMP 76779149 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007680144a 2 bytes CALL 766d4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                         * 9
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000768014dd 2 bytes JMP 76778a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000768014f5 2 bytes JMP 76778c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007680150d 2 bytes JMP 76778938 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000076801525 2 bytes JMP 76778d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007680153d 2 bytes JMP 766efcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000076801555 2 bytes JMP 766f6907 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007680156d 2 bytes JMP 76779201 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000076801585 2 bytes JMP 76778d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007680159d 2 bytes JMP 767788fc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000768015b5 2 bytes JMP 766efd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000768015cd 2 bytes JMP 766fb2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000768016b2 2 bytes JMP 767790c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\TeamViewer\TeamViewer_Service.exe[2716] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000768016bd 2 bytes JMP 76778891 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                              0000000076801401 2 bytes JMP 766fb233 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                                0000000076801419 2 bytes JMP 766fb35e C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                              0000000076801431 2 bytes JMP 76779149 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                              000000007680144a 2 bytes CALL 766d4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                         * 9
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                                 00000000768014dd 2 bytes JMP 76778a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                          00000000768014f5 2 bytes JMP 76778c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                                 000000007680150d 2 bytes JMP 76778938 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                          0000000076801525 2 bytes JMP 76778d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                                000000007680153d 2 bytes JMP 766efcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                     0000000076801555 2 bytes JMP 766f6907 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                              000000007680156d 2 bytes JMP 76779201 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                                0000000076801585 2 bytes JMP 76778d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                                   000000007680159d 2 bytes JMP 767788fc C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                                00000000768015b5 2 bytes JMP 766efd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                              00000000768015cd 2 bytes JMP 766fb2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                          00000000768016b2 2 bytes JMP 767790c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\RunDll32.exe[3452] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                          00000000768016bd 2 bytes JMP 76778891 C:\Windows\syswow64\kernel32.dll

---- Disk sectors - GMER 2.2 ----

Disk   \Device\Harddisk0\DR0                                                                                                       unknown MBR code

---- EOF - GMER 2.2 ----