GMER 2.1.18952 - http://www.gmer.net Rootkit scan 2013-02-22 14:50:55 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0002 465,76GB Running: 9wg45px7.exe; Driver: C:\Users\iwa\AppData\Local\Temp\uxriipow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000758a1465 2 bytes [8A, 75] .text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[1732] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758a14bb 2 bytes [8A, 75] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\system32\svchost.exe [728:4408] 000007fef4c82154 Thread C:\Windows\system32\svchost.exe [1140:5052] 000007fefa7d4164 Thread C:\Windows\system32\svchost.exe [1704:1756] 000007fef90d341c Thread C:\Windows\system32\svchost.exe [1704:1764] 000007fef90d3a2c Thread C:\Windows\system32\svchost.exe [1704:1768] 000007fef90d3768 Thread C:\Windows\system32\svchost.exe [1704:1772] 000007fef90d5c20 Thread C:\Windows\system32\svchost.exe [1704:2320] 000007fef7c0bec4 Thread C:\Windows\system32\svchost.exe [1704:2692] 000007fef7ab5124 Thread C:\Windows\system32\svchost.exe [1704:3432] 000007fef5b85170 Thread C:\Windows\system32\svchost.exe [1704:5232] 000007fef90d3900 Thread C:\Windows\System32\spoolsv.exe [1964:3060] 000007fef6b410c8 Thread C:\Windows\System32\spoolsv.exe [1964:3080] 000007fef6b06144 Thread C:\Windows\System32\spoolsv.exe [1964:3084] 000007fef62c5fd0 Thread C:\Windows\System32\spoolsv.exe [1964:3088] 000007fef62b3438 Thread C:\Windows\System32\spoolsv.exe [1964:3092] 000007fef62c63ec Thread C:\Windows\System32\spoolsv.exe [1964:3100] 000007fef6bd5e5c Thread C:\Windows\System32\spoolsv.exe [1964:3104] 000007fef6c05074 Thread C:\Windows\System32\spoolsv.exe [1964:3128] 000007fef6c72288 Thread C:\Windows\system32\taskhost.exe [3928:3492] 000007fef8002740 Thread C:\Windows\system32\taskhost.exe [3928:1216] 000007fefa251010 Thread C:\Windows\system32\taskhost.exe [3928:1292] 000007fef5631f38 ---- EOF - GMER 2.1 ----