GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2017-02-24 12:29:40
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP5T0L0-6 GOODRAM rev.SAFM01.7 223,57GB
Running: ygu02o5o.exe; Driver: C:\Users\karol\AppData\Local\Temp\pwrdykod.sys


---- User code sections - GMER 2.2 ----

.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                          0000000076341401 2 bytes JMP 773ab233 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                            0000000076341419 2 bytes JMP 773ab35e C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                          0000000076341431 2 bytes JMP 77429149 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                          000000007634144a 2 bytes CALL 77384885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                               * 9
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                             00000000763414dd 2 bytes JMP 77428a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                      00000000763414f5 2 bytes JMP 77428c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                             000000007634150d 2 bytes JMP 77428938 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                      0000000076341525 2 bytes JMP 77428d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                            000000007634153d 2 bytes JMP 7739fcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                 0000000076341555 2 bytes JMP 773a6907 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                          000000007634156d 2 bytes JMP 77429201 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                            0000000076341585 2 bytes JMP 77428d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                               000000007634159d 2 bytes JMP 774288fc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                            00000000763415b5 2 bytes JMP 7739fd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                          00000000763415cd 2 bytes JMP 773ab2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                      00000000763416b2 2 bytes JMP 774290c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[1304] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                      00000000763416bd 2 bytes JMP 77428891 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000076341401 2 bytes JMP 773ab233 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000076341419 2 bytes JMP 773ab35e C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000076341431 2 bytes JMP 77429149 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007634144a 2 bytes CALL 77384885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                               * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000763414dd 2 bytes JMP 77428a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000763414f5 2 bytes JMP 77428c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007634150d 2 bytes JMP 77428938 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000076341525 2 bytes JMP 77428d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007634153d 2 bytes JMP 7739fcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000076341555 2 bytes JMP 773a6907 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007634156d 2 bytes JMP 77429201 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000076341585 2 bytes JMP 77428d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007634159d 2 bytes JMP 774288fc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000763415b5 2 bytes JMP 7739fd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000763415cd 2 bytes JMP 773ab2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000763416b2 2 bytes JMP 774290c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvTelemetry\NvTelemetryContainer.exe[2280] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000763416bd 2 bytes JMP 77428891 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                     0000000076202bdc 5 bytes JMP 000000007376bac2
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17               0000000076341401 2 bytes JMP 773ab233 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                 0000000076341419 2 bytes JMP 773ab35e C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17               0000000076341431 2 bytes JMP 77429149 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42               000000007634144a 2 bytes CALL 77384885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                               * 9
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                  00000000763414dd 2 bytes JMP 77428a42 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17           00000000763414f5 2 bytes JMP 77428c18 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                  000000007634150d 2 bytes JMP 77428938 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17           0000000076341525 2 bytes JMP 77428d02 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                 000000007634153d 2 bytes JMP 7739fcc0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                      0000000076341555 2 bytes JMP 773a6907 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17               000000007634156d 2 bytes JMP 77429201 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                 0000000076341585 2 bytes JMP 77428d62 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                    000000007634159d 2 bytes JMP 774288fc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                 00000000763415b5 2 bytes JMP 7739fd59 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17               00000000763415cd 2 bytes JMP 773ab2f4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20           00000000763416b2 2 bytes JMP 774290c4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\NVIDIA Corporation\NvContainer\nvcontainer.exe[2168] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31           00000000763416bd 2 bytes JMP 77428891 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2260] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                      0000000077782280 5 bytes JMP 000000000042075c
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2260] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                        0000000077786130 5 bytes JMP 00000000004203a4
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2260] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                00000000777abfb0 14 bytes {MOV RAX, 0x7feee1572b0; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4052] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                      0000000077782280 5 bytes JMP 00000000003e075c
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4052] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                        0000000077786130 5 bytes JMP 00000000003e03a4
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                      0000000077782280 5 bytes JMP 000000000009075c
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                        0000000077786130 5 bytes JMP 00000000000903a4
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            00000000777abe00 7 bytes [48, B8, 60, 04, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8                        00000000777abe08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                 00000000777abf70 7 bytes [48, B8, E0, 04, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                             00000000777abf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                     00000000777abf90 7 bytes [48, B8, D0, 08, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                 00000000777abf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                              00000000777abfa0 7 bytes [48, B8, C0, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                          00000000777abfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                00000000777abfb0 7 bytes [48, B8, 40, 03, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                            00000000777abfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                              00000000777abfd0 7 bytes [48, B8, B0, 03, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                          00000000777abfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                               00000000777ac020 7 bytes [48, B8, 50, 05, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8                           00000000777ac028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                              00000000777ac030 7 bytes [48, B8, 20, 09, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8                          00000000777ac038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                        00000000777ac060 7 bytes [48, B8, 40, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                    00000000777ac068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                             00000000777ac100 7 bytes [48, B8, 80, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8                         00000000777ac108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                      00000000777ac280 7 bytes [48, B8, C0, 05, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                  00000000777ac288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                00000000777accf0 7 bytes [48, B8, 00, 09, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8                            00000000777accf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                      00000000777acd40 7 bytes [48, B8, A0, 08, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                                  00000000777acd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                         00000000777ace90 7 bytes [48, B8, A0, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[4748] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8                     00000000777ace98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!LdrUnloadDll                                      0000000077782280 5 bytes JMP 000000000025075c
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!LdrLoadDll                                        0000000077786130 5 bytes JMP 00000000002503a4
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread                            00000000777abe00 7 bytes [48, B8, 60, 04, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationThread + 8                        00000000777abe08 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken                                 00000000777abf70 7 bytes [48, B8, E0, 04, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadToken + 8                             00000000777abf78 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess                                     00000000777abf90 7 bytes [48, B8, D0, 08, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcess + 8                                 00000000777abf98 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile                              00000000777abfa0 7 bytes [48, B8, C0, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtSetInformationFile + 8                          00000000777abfa8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection                                00000000777abfb0 7 bytes [48, B8, 40, 03, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtMapViewOfSection + 8                            00000000777abfb8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection                              00000000777abfd0 7 bytes [48, B8, B0, 03, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtUnmapViewOfSection + 8                          00000000777abfd8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx                               00000000777ac020 7 bytes [48, B8, 50, 05, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThreadTokenEx + 8                           00000000777ac028 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx                              00000000777ac030 7 bytes [48, B8, 20, 09, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessTokenEx + 8                          00000000777ac038 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile                                        00000000777ac060 7 bytes [48, B8, 40, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenFile + 8                                    00000000777ac068 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile                             00000000777ac100 7 bytes [48, B8, 80, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtQueryAttributesFile + 8                         00000000777ac108 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile                                      00000000777ac280 7 bytes [48, B8, C0, 05, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtCreateFile + 8                                  00000000777ac288 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken                                00000000777accf0 7 bytes [48, B8, 00, 09, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenProcessToken + 8                            00000000777accf8 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread                                      00000000777acd40 7 bytes [48, B8, A0, 08, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtOpenThread + 8                                  00000000777acd48 6 bytes {ADD [RAX], AL; JMP RAX}
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile                         00000000777ace90 7 bytes [48, B8, A0, 06, 29, 3F, 01]
.text  C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] C:\Windows\SYSTEM32\ntdll.dll!NtQueryFullAttributesFile + 8                     00000000777ace98 6 bytes {ADD [RAX], AL; JMP RAX}

---- User IAT/EAT - GMER 2.2 ----

IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenServiceW]                     [7fedeb99010] C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!CloseServiceHandle]               [7fedeb98874] C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!OpenSCManagerW]                   [7fedeb98ff8] C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] @ C:\Windows\system32\DWrite.dll[ADVAPI32.dll!StartServiceW]                    [7fedeb99244] C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\chrome_child.dll
IAT    C:\Program Files (x86)\Google\Chrome\Application\chrome.exe[2104] @ C:\Windows\system32\DWrite.dll[ntdll.dll!NtAlpcConnectPort]                   [7feddb52348] C:\Program Files (x86)\Google\Chrome\Application\56.0.2924.87\chrome_child.dll

---- Registry - GMER 2.2 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\Instup_14863808484522286@SetupOperations                                                ???~???? ????????????????C????????????<????????g????NO_DRV_X?????????????????x???????????s???~?~?????x???????x???6???????0???????????6???????????????????6??4????????????x??????????????? ???????/?????x???????.??(??????? ?????????????????? ???????x?????????????.??"???&????????????????????????x????? ???????A?????Act?????????x???x??tabl??ol????*??x???=?????????nor??Port_#0006.Hub_#0004?R???????????n??????=%??? ???????x?????????????.?????????????????f??????????? l??x???.?????328??USB\VID_04E8&PID_1F03&REV_0000?USB\VID_04E8&PID_1F03????? ???x???<???????x??USB\Class_08&SubClass_06&Prot_50?USB\Class_08&SubClass_06?USB\Class_08??ro????N??x???e?????D=5??{0d7cda8b-cd42-5fcb-8f4e-444e65438ae7}?Sys????X??x???x???x??? ???????x?????x???????0??L????????? ??????dll??? ???????x?????????????0????????????&????????????????????.??? ?????????????????????0??L????????? ???????????disk.inf????? ???????x?????????????0????????????&????????????????????7???????????????????????????l?????s|A?????????????????????????????????????????????????
Reg    HKLM\SYSTEM\CurrentControlSet\services\aswRvrt\Parameters\Instup_14863808576872286@SetupOperations                                                ????ra??????????????????????????????????ui??? ?????????????????????0????????????????????? ???????????????????9?0????????????????????????????? ?????????????????????*????????*?\?&?????????????????????????N????????????D??????(??????????????????????????????????????????????????????.?4?4?4?4?4?0?0?0?3????????gendisk??????|????X??????????????????????0???????????D??????????????????????????????????????????????????????HD Audio ? g?o?nik?-A5????&??????3???????1???b?b?b?b?????????b??{4d36e97d-e325-11ce-bfc1-08002be10318}\0018?????????????????????????????????nvvad64v.sys????@msmouse.inf,%msmfg%;Microsoft???????????????????????e??????????????????????????????????????????usb\class_08&subclass_06&prot_50????? ???????\???????????U????H?????l???$???????????????????mR??@%SystemRoot%\system32\mshtml.dll,-2660;RES_ICO_FRAME???@%SystemRoot%\system32\mshtml.dll,-2400;SubgroupName????@%SystemRoot%\system32\mshtml.dll,-2401;SubgroupDesc????? ???????????????????l????0?????r???$?????????????????????????????????????????????r??????n?????
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                               0
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                            0xF9 0x18 0x34 0x36 ...
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                               C:\Program Files\DAEMON Tools Pro\
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                                                  
Reg    HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                               J:\demon\DAEMON Tools Lite\
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\Instup_14863808484522286@SetupOperations                                                    ????)???v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=6|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=fdphost|Name=@FirewallAPI.dll,-30822|Desc=@FirewallAPI.dll,-30823|EmbedCtxt=@FirewallAPI.dll,-30752|????D???????????????????????????????????????????????j?j?o?o?o?o?j???????????I??????????????????????????????????????????? ??????????????????hdaudio\func_01&ven_10ec&dev_0883???????????????????????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=6|Profile=Private|Profile=Public|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\wudfhost.exe|Name=@FirewallAPI.dll,-30503|Desc=@FirewallAPI.dll,-30506|EmbedCtxt=@FirewallAPI.dll,-30502|???v2.10|Action=Allow|Active=FALSE|Dir=In|Protocol=17|LPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemRoot%\system32\svchost.exe|Svc=Ssdpsrv|Name=@FirewallAPI.dll,-30507|Desc=@FirewallAPI.dll,-30510|EmbedCtxt=@FirewallAPI.dll,-30502|????v2.10|Action=Allow|Active=FALSE|Dir=Out|Protocol=17|RPort=1900|RA4=LocalSubnet|RA6=LocalSubnet|App=%SystemR
Reg    HKLM\SYSTEM\ControlSet002\services\aswRvrt\Parameters\Instup_14863808576872286@SetupOperations                                                    ????\A??????????????????????????????????n4???????????c???????????????m???n??????????? ????????????????????????????????????8??????????????????p??????????? ???????????????????,?,?b?d?d?d?,?d?d?d?d?d?d?d?d?d?d?d?d?d?d?d?d?d?d?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e?e??????????????????????????????????????????????????????????????ACPI\GenuineIntel_-_Intel64_Family_6_Model_15?*GenuineIntel_-_Intel64_Family_6_Model_15?ACPI\GenuineIntel_-_Intel64_Family_6?*GenuineIntel_-_Intel64_Family_6?ACPI\GenuineIntel_-_Intel64?*GenuineIntel_-_Intel64????????????????????????????o??????????????????????????{00000000-0000-0000-ffff-ffffffffffff}??????ADATA UFD????????o??????????????????????????ACPI\GenuineIntel_-_Intel64_Family_6_Model_15?*GenuineIntel_-_Intel64_Family_6_Model_15?ACPI\GenuineIntel_-_Intel64_Family_6?*GenuineIntel_-_Intel64_Family_6?ACPI\GenuineIntel_-_Intel64?*GenuineIntel_-_Intel64?????????$????????????e????ACPI\GenuineIntel_-_Intel64_Family_6_Model_15?*GenuineIntel_-_Intel64_Family_6_Model_15?ACPI\GenuineInt
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0                                                                   0
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew                                                                0xF9 0x18 0x34 0x36 ...
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0                                                                   C:\Program Files\DAEMON Tools Pro\
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                                              
Reg    HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                                   J:\demon\DAEMON Tools Lite\

---- EOF - GMER 2.2 ----