GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-11-15 22:13:29
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 SAMSUNG_HM320II rev.2AC101C4 298,09GB
Running: 9r6zsw9e.exe; Driver: C:\Users\Kamila\AppData\Local\Temp\fgkdapod.sys


---- System - GMER 2.1 ----

SSDT   8E45342E                                                                                           ZwCreateSection
SSDT   8E453438                                                                                           ZwRequestWaitReplyPort
SSDT   8E453433                                                                                           ZwSetContextThread
SSDT   8E45343D                                                                                           ZwSetSecurityObject
SSDT   8E453442                                                                                           ZwSystemDebugControl
SSDT   8E4533CF                                                                                           ZwTerminateProcess

---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwRollbackEnlistment + 142D                                                           82C7FA15 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                             82CB9212 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text  ntkrnlpa.exe!KeRemoveQueueEx + 11F7                                                                82CC058C 4 Bytes  [2E, 34, 45, 8E]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1553                                                                82CC08E8 4 Bytes  [38, 34, 45, 8E]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1597                                                                82CC092C 4 Bytes  [33, 34, 45, 8E]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1613                                                                82CC09A8 4 Bytes  [3D, 34, 45, 8E]
.text  ntkrnlpa.exe!KeRemoveQueueEx + 1667                                                                82CC09FC 4 Bytes  [42, 34, 45, 8E]
.text  ...                                                                                                
       C:\Program Files\CyberLink\PowerDVD8\000.fcl                                                       entry point in "" section [0x9BB7F000]
.clc   C:\Program Files\CyberLink\PowerDVD8\000.fcl                                                       unknown last section [0x9BB80000, 0x1000, 0x00000000]

---- User IAT/EAT - GMER 2.1 ----

IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                    [741624CB] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]               [7414562E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]              [741456EC] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                     [74162546] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]           [741585AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]             [74154D5E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]            [74155105] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]           [741551DA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]  [74156707] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]            [74158301] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]       [74158850] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]     [741590B1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]           [7415E254] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[2172] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]               [74154C90] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.18120_none_72d2e82386681b36\gdiplus.dll

---- EOF - GMER 2.1 ----