GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-09-05 17:54:34
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-2 Hitachi_HDT725025VLA380 rev.V5DOA52A
Running: 1epslctf.exe; Driver: C:\Users\KRZYSZ~2\AppData\Local\Temp\kwrdiuog.sys


---- Kernel code sections - GMER 1.0.15 ----

.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V                                                               8E756004 21 Bytes  [00, 00, 8B, FF, 55, 8B, EC, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V                                                               8E75601A 90 Bytes  [08, FF, 15, 84, 61, 76, 8E, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V                                                               8E756075 68 Bytes  [75, 10, FF, 75, 14, 6A, 2B, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V                                                               8E7560BB 1 Byte  [0C]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V                                                               8E7560BB 213 Bytes  [0C, FF, 75, 08, FF, 15, 84, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V + 68                                                             8E756DFD 21 Bytes  [84, B0, 00, 00, 00, C0, E9, ...]
.text           tdx.sys!?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V + 7E                                                             8E756E13 68 Bytes  [50, 76, 8E, 8D, 85, 7C, FF, ...]
.text           tdx.sys!?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V + C3                                                             8E756E58 234 Bytes  [FF, FF, 8B, 35, 00, 60, 76, ...]
.text           tdx.sys!?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V + 1AE                                                            8E756F43 619 Bytes  [0B, 00, 00, 53, 57, E8, BB, ...]
.text           tdx.sys!?FormatFolderPathHeaderRect@@ADJKDPAGPA_N<V + 41A                                                            8E7571AF 345 Bytes  [C0, 8B, 45, D4, 83, 60, 1C, ...]
.text           tdx.sys!?HideFilePathEventThread@@ADIEEM<V + 102                                                                     8E757309 108 Bytes  [24, 80, 78, 1D, 05, 72, 1E, ...]
.text           tdx.sys!?HideFilePathEventThread@@ADIEEM<V + 16F                                                                     8E757376 589 Bytes  [00, BF, 52, 3B, 76, 8E, 57, ...]
.text           tdx.sys!?HideFilePathEventThread@@ADIEEM<V + 3BD                                                                     8E7575C4 87 Bytes  [C0, 8D, 7D, 90, F3, AB, A1, ...]
.text           tdx.sys!?HideFilePathEventThread@@ADIEEM<V + 415                                                                     8E75761C 102 Bytes  [98, FF, FF, 00, 00, C7, 45, ...]
.text           tdx.sys!?CancelFilePathRectWindowScreenExW@@ADPAXD<V + A                                                             8E757683 19 Bytes  [00, C7, 45, A4, 80, 00, 00, ...]
.text           tdx.sys!?CancelFilePathRectWindowScreenExW@@ADPAXD<V + 1E                                                            8E757697 76 Bytes  [00, 75, 10, 57, 57, 57, 57, ...]
.text           tdx.sys!?CancelFilePathRectWindowScreenExW@@ADPAXD<V + 6B                                                            8E7576E4 471 Bytes  [89, 85, 5C, FF, FF, FF, 8B, ...]
.text           tdx.sys!?CancelFilePathRectWindowScreenExW@@ADPAXD<V + 243                                                           8E7578BC 5 Bytes  [00, 00, 75, 23, 33]
.text           tdx.sys!?CancelFilePathRectWindowScreenExW@@ADPAXD<V + 249                                                           8E7578C2 55 Bytes  [50, 50, 50, 50, FF, 75, E4, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?DeleteObjectFolderProcessTimeA@@ADHI<V + 4                                                                  8E7580B1 217 Bytes  [C7, 04, 89, 8D, 68, FF, FF, ...]
.text           tdx.sys!?DeleteObjectFolderProcessTimeA@@ADHI<V + DE                                                                 8E75818B 103 Bytes  [89, 85, 40, FF, FF, FF, 8D, ...]
.text           tdx.sys!?DeleteObjectFolderProcessTimeA@@ADHI<V + 146                                                                8E7581F3 238 Bytes  [04, 89, 10, 89, 01, 8B, 8D, ...]
.text           tdx.sys!?DeleteObjectFolderProcessTimeA@@ADHI<V + 235                                                                8E7582E2 461 Bytes  [43, 14, 01, BD, 60, FF, FF, ...]
.text           tdx.sys!?DeleteObjectFolderProcessTimeA@@ADHI<V + 403                                                                8E7584B0 97 Bytes  [70, FF, FF, FF, 83, 60, 18, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?GlobalProviderKeyNameFolderW@@ADIKPAMIPAG<V + 327                                                           8E758846 273 Bytes  CALL 8E75688E \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?GlobalProviderKeyNameFolderW@@ADIKPAMIPAG<V + 439                                                           8E758958 136 Bytes  [55, 8B, EC, 83, EC, 10, 57, ...]
.text           tdx.sys!?PutThreadMessageProfile@@ADMF<V + 50                                                                        8E7589E1 139 Bytes  [01, 00, 00, 8B, 30, EB, 43, ...]
.text           tdx.sys!?PutThreadMessageProfile@@ADMF<V + DC                                                                        8E758A6D 74 Bytes  [8E, 56, 89, 75, F8, E8, 53, ...]
.text           tdx.sys!?PutThreadMessageProfile@@ADMF<V + 127                                                                       8E758AB8 523 Bytes  [1F, FF, 75, F0, FF, 75, 0C, ...]
.text           tdx.sys!?PutThreadMessageProfile@@ADMF<V + 333                                                                       8E758CC4 154 Bytes  [89, 45, 10, EB, 5C, 80, 7D, ...]
.text           tdx.sys!?PutThreadMessageProfile@@ADMF<V + 3CE                                                                       8E758D5F 8 Bytes  [EC, 51, 76, 8E, 6A, 1E, FF, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?SetFullNameFullNameProviderW@@ADMIPAK_N<V + 1E                                                              8E758E21 34 Bytes  [F6, 03, 04, 0F, 84, 3F, 01, ...]
.text           tdx.sys!?SetFullNameFullNameProviderW@@ADMIPAK_N<V + 41                                                              8E758E44 70 Bytes  JMP 8E758F74 \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?SetFullNameFullNameProviderW@@ADMIPAK_N<V + 88                                                              8E758E8B 286 Bytes  [52, 3B, 76, 8E, 53, E8, 77, ...]
.text           tdx.sys!?SetFullNameFullNameProviderW@@ADMIPAK_N<V + 1A7                                                             8E758FAA 334 Bytes  CALL 8E759DFB \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?SetFullNameFullNameProviderW@@ADMIPAK_N<V + 2F6                                                             8E7590F9 423 Bytes  [83, EC, 0C, 53, 8B, 1D, 0C, ...]
.text           tdx.sys!?KillDatePenStateOld@@AD_NEPAHPA_NPAD<V + 2C                                                                 8E7592A1 321 Bytes  [FF, 68, 2D, 0D, 00, 00, 68, ...]
.text           tdx.sys!?KillDatePenStateOld@@AD_NEPAHPA_NPAD<V + 16E                                                                8E7593E3 204 Bytes  [04, 00, 00, 53, 57, E8, 1F, ...]
.text           tdx.sys!?KillDatePenStateOld@@AD_NEPAHPA_NPAD<V + 23B                                                                8E7594B0 599 Bytes  [32, 8D, 46, A8, 8B, 36, 33, ...]
.text           tdx.sys!?FindStringModuleTaskMonitorA@@ADPAHD<V + 21                                                                 8E759708 220 Bytes  [CC, CC, CC, CC, CC, CC, 8B, ...]
.text           tdx.sys!?FindStringModuleTaskMonitorA@@ADPAHD<V + FE                                                                 8E7597E5 150 Bytes  [80, 7E, E4, 00, 8A, D0, 88, ...]
.text           tdx.sys!?FindStringModuleTaskMonitorA@@ADPAHD<V + 195                                                                8E75987C 374 Bytes  [8E, 6A, 23, FF, 70, 14, FF, ...]
.text           tdx.sys!?FindStringModuleTaskMonitorA@@ADPAHD<V + 30C                                                                8E7599F3 105 Bytes  CALL 8E756980 \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?FindStringModuleTaskMonitorA@@ADPAHD<V + 376                                                                8E759A5D 225 Bytes  [FF, 33, C0, 38, 45, 10, 6A, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?FindWindowDeviceConfigAppNameOld@@ADGPAD<V + 97                                                             8E759BF0 385 Bytes  [C6, 8D, 50, 01, 8A, 08, 40, ...]
.text           tdx.sys!?FindWindowDeviceConfigAppNameOld@@ADGPAD<V + 219                                                            8E759D72 122 Bytes  [05, 58, 85, FF, 8B, CF, 75, ...]
.text           tdx.sys!?FindWindowDeviceConfigAppNameOld@@ADGPAD<V + 294                                                            8E759DED 114 Bytes  CALL 8E759AF2 \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?FindWindowDeviceConfigAppNameOld@@ADGPAD<V + 307                                                            8E759E60 110 Bytes  [08, 8B, 46, 18, 85, C0, 74, ...]
.text           tdx.sys!?FindWindowDeviceConfigAppNameOld@@ADGPAD<V + 376                                                            8E759ECF 36 Bytes  CALL 8E759DFC \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           ...                                                                                                                  
.text           tdx.sys!?CallDirectoryStateTextMediaTypeNew@@ADPAMPAHPAHPAHPAE<V + 28                                                8E75A8FB 307 Bytes  [75, F0, FF, 75, F8, FF, 55, ...]
.text           tdx.sys!?CallDirectoryStateTextMediaTypeNew@@ADPAMPAHPAHPAHPAE<V + 15C                                               8E75AA2F 157 Bytes  CALL 8E75A767 \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?CallDirectoryStateTextMediaTypeNew@@ADPAMPAHPAHPAHPAE<V + 1FA                                               8E75AACD 407 Bytes  [89, 45, F4, 74, 0B, 8D, 73, ...]
.text           tdx.sys!?CallDirectoryStateTextMediaTypeNew@@ADPAMPAHPAHPAHPAE<V + 392                                               8E75AC65 307 Bytes  [68, 22, 0C, 00, 00, 68, 94, ...]
.text           tdx.sys!?PutDeviceProfilePathEx@@ADPAIEIJ_N<V + 54                                                                   8E75AD99 60 Bytes  [FF, 8D, 45, 08, 50, FF, 75, ...]
.text           tdx.sys!?PutDeviceProfilePathEx@@ADPAIEIJ_N<V + 91                                                                   8E75ADD6 653 Bytes  [CC, CC, CC, CC, 8B, FF, 55, ...]
.text           tdx.sys!?PutDeviceProfilePathEx@@ADPAIEIJ_N<V + 31F                                                                  8E75B064 193 Bytes  CALL 8E763672 \SystemRoot\system32\DRIVERS\tdx.sys (TDI Translation Driver/Microsoft Corporation)
.text           tdx.sys!?PutDeviceProfilePathEx@@ADPAIEIJ_N<V + 3E1                                                                  8E75B126 414 Bytes  [20, 74, 14, 56, 57, 68, FC, ...]
.text           tdx.sys!?AddArgumentAnchorScreenOptionEx@@ADPAH_NGPAFF<V + 10E                                                       8E75B2C5 481 Bytes  [00, B2, 02, 8B, CF, C7, 47, ...]
.text           tdx.sys!?AddArgumentAnchorScreenOptionEx@@ADPAH_NGPAFF<V + 2F0                                                       8E75B4A7 372 Bytes  [21, FF, 76, 30, FF, B6, E4, ...]
.text           tdx.sys!?AddArgumentAnchorScreenOptionEx@@ADPAH_NGPAFF<V + 465                                                       8E75B61C 46 Bytes  [FC, 51, 76, 8E, 6A, 29, FF, ...]
.text           tdx.sys!?CloseSemaphoreTimerCharEx@@ADXKIM<V + 22                                                                    8E75B64B 125 Bytes  [00, 00, C7, 46, 34, 04, 00, ...]
.text           tdx.sys!?CloseSemaphoreTimerCharEx@@ADXKIM<V + A0                                                                    8E75B6C9 90 Bytes  [15, 10, 51, 76, 8E, 8D, 45, ...]
.text           tdx.sys!?CloseSemaphoreTimerCharEx@@ADXKIM<V + FB                                                                    8E75B724 503 Bytes  [7D, 0C, 68, 34, 07, 00, 00, ...]
.text           tdx.sys!?CloseSemaphoreTimerCharEx@@ADXKIM<V + 2F3                                                                   8E75B91C 83 Bytes  [51, 76, 8E, FF, 75, 0C, FF, ...]
.text           tdx.sys!?CloseSemaphoreTimerCharEx@@ADXKIM<V + 347                                                                   8E75B970 300 Bytes  [75, 11, 6A, 01, FF, 75, FC, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?FolderPathExpressionSizeValueOld@@ADKNFPAI<V + 81                                                           8E75BB79 265 Bytes  [C3, 0F, 84, 6A, FF, FF, FF, ...]
.text           tdx.sys!?FolderPathExpressionSizeValueOld@@ADKNFPAI<V + 18B                                                          8E75BC83 4 Bytes  [34, 83, F8, 04]
.text           tdx.sys!?FolderPathExpressionSizeValueOld@@ADKNFPAI<V + 190                                                          8E75BC88 354 Bytes  [55, 0B, 0F, 8C, E4, 00, 00, ...]
.text           tdx.sys!?FolderPathExpressionSizeValueOld@@ADKNFPAI<V + 2F3                                                          8E75BDEB 4 Bytes  [F8, 07, 7D, 0E] {CLC ; POP ES; JGE 0x12}
.text           tdx.sys!?FolderPathExpressionSizeValueOld@@ADKNFPAI<V + 2F8                                                          8E75BDF0 130 Bytes  [75, 08, FF, 75, 0C, 56, E8, ...]
.text           ...                                                                                                                  
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V + A                                                           8E75C599 23 Bytes  [00, 8B, 86, D8, 00, 00, 00, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V + 22                                                          8E75C5B1 39 Bytes  [00, 3B, C3, 74, 0A, FF, 75, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V + 4A                                                          8E75C5D9 547 Bytes  [02, 00, C0, 5F, 5E, 5B, C9, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V + 26E                                                         8E75C7FD 171 Bytes  [00, A1, 00, 60, 76, 8E, 3D, ...]
.text           tdx.sys!?CloseExpressionValueDateProfile@@ADJPA_NPAM<V + 31A                                                         8E75C8A9 77 Bytes  [08, 8B, 40, 0C, 3B, C1, 89, ...]
.text           ...                                                                                                                  
.rsrc           C:\Windows\system32\DRIVERS\tdx.sys                                                                                  section is executable [0x8E764000, 0x3854, 0x68000020]
?               C:\Windows\system32\DRIVERS\tdx.sys                                                                                  suspicious PE modification

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] ntdll.dll!LdrLoadDll                                               770F9378 5 Bytes  JMP 623B6C40 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] kernel32.dll!HeapSetInformation + 26                               76EBA8C0 7 Bytes  JMP 623BFE71 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] kernel32.dll!LockResource + C                                      76ED6B0B 7 Bytes  JMP 625F2D9C C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] kernel32.dll!VirtualAllocEx + 54                                   76EDAF70 7 Bytes  JMP 625F2DBF C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] GDI32.dll!SetStretchBltMode + 256                                  772E745C 7 Bytes  JMP 625F2D1D C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] CRYPT32.dll!CertDuplicateCRLContext + 5A                           750D8155 7 Bytes  JMP 0095DCD0 
.text           C:\Program Files\Mozilla Firefox\firefox.exe[292] CRYPT32.dll!I_CryptFreeLruCache + 1E4                              750DD3E2 7 Bytes  JMP 0095DD40 
.text           C:\Windows\System32\svchost.exe[2752] ole32.dll!CoCreateInstance                                                     75D49F3E 5 Bytes  JMP 008D000A 
.text           C:\Windows\System32\svchost.exe[2752] USER32.dll!GetCursorPos                                                        757B0B88 5 Bytes  JMP 00A4000A 
.text           C:\Windows\System32\svchost.exe[2752] USER32.dll!DialogBoxIndirectParamAorW                                          757C2EB6 5 Bytes  JMP 00A5000A 

---- Kernel IAT/EAT - GMER 1.0.15 ----

IAT             \SystemRoot\system32\DRIVERS\tdx.sys[HAL.dll!KeQueryPerformanceCounter]                                              46895FC0

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                 [73DE7817] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                  [73E2B4E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                              [73DEBB22] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                        [73DDF695] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                  [73DE75E9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                               [73DDE7CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM]                   [73E173F5] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream]                      [73DEDA60] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                              [73DDFFFA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                               [73DDFF61] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                                [73DD71CF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM]                        [73E6CAE2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile]                           [73E0C8D8] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                              [73DDD968] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                        [73DD6853] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                       [73DD687E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT             C:\Windows\Explorer.EXE[204] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                          [73DE2AD1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6002.18581_none_9e591052ca1013d0\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                                             fltmgr.sys (Menedżer filtrów systemu plików firmy Microsoft/Microsoft Corporation)

---- Processes - GMER 1.0.15 ----

Process         C:\Windows\System32\svchost.exe (*** hidden *** )                                                                    2752                                                                                                                                                                 

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd60e843                                          
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd60e843@001e45ce6135                             0xC6 0xF7 0xA3 0xEF ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0009dd60e843@402ba1a8c5d2                             0xA5 0x0B 0xD9 0x19 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                  0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                  1
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                               0x1C 0x22 0x1F 0x43 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0xD9 0xE9 0x65 0x6B ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0xA1 0xF9 0x09 0x04 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x4D 0xF6 0x08 0x71 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                0xFE 0xF4 0x80 0xE3 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0009dd60e843 (not active ControlSet)                      
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0009dd60e843@001e45ce6135                                 0xC6 0xF7 0xA3 0xEF ...
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\0009dd60e843@402ba1a8c5d2                                 0xA5 0x0B 0xD9 0x19 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                                      0xD4 0xC3 0x97 0x02 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                                      1
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                                   0x1C 0x22 0x1F 0x43 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xD9 0xE9 0x65 0x6B ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0xA1 0xF9 0x09 0x04 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x4D 0xF6 0x08 0x71 ...
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf41@khjeh                    0xFE 0xF4 0x80 0xE3 ...

---- Files - GMER 1.0.15 ----

File            C:\Windows\$NtUninstallKB13661$\1884308749                                                                           0 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\@                                                                         2048 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\Desktop.ini                                                               4608 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\L                                                                         0 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\L\00000004.@                                                              804 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\L\201d3dde                                                                164 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\L\qnbwvoto                                                                72192 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U                                                                         0 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U\00000004.@                                                              2048 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U\00000008.@                                                              232960 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U\000000cb.@                                                              1632 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U\80000000.@                                                              13312 bytes
File            C:\Windows\$NtUninstallKB13661$\1884308749\U\80000032.@                                                              90624 bytes
File            C:\Windows\$NtUninstallKB13661$\419713489                                                                            0 bytes

---- EOF - GMER 1.0.15 ----