GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-12-19 20:34:20 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000007c ATA_____ rev.0003 931,51GB Running: zmnfdsgw.exe; Driver: C:\Users\Kuba\AppData\Local\Temp\aftcaaog.sys ---- Kernel code sections - GMER 2.1 ---- INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 544 fffff800033fe000 63 bytes [00, 00, 15, 02, 46, 69, 6C, ...] INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 608 fffff800033fe040 1 byte [10] ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1720] C:\Windows\SysWOW64\ntdll.dll!NtQueryValueKey 0000000077b6faa8 5 bytes JMP 00000001735819e8 .text C:\Program Files (x86)\Kaspersky Lab\Kaspersky Anti-Virus 2013\avp.exe[1720] C:\Windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory 0000000077b70038 5 bytes JMP 000000017358209e .text E:\Program Files (x86)\Steam\Steam.exe[6308] C:\Windows\syswow64\KERNELBASE.dll!HeapCreate 0000000075a7549c 5 bytes JMP 00000001000f0800 .text E:\Program Files (x86)\Steam\Steam.exe[6308] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000758b1465 2 bytes [8B, 75] .text E:\Program Files (x86)\Steam\Steam.exe[6308] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000758b14bb 2 bytes [8B, 75] .text ... * 2 .text C:\Users\Kuba\Downloads\OTL.exe[864] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69 00000000758b1465 2 bytes [8B, 75] .text C:\Users\Kuba\Downloads\OTL.exe[864] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155 00000000758b14bb 2 bytes [8B, 75] .text ... * 2 ---- Kernel IAT/EAT - GMER 2.1 ---- IAT C:\Windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback] [fffff88004e99ea4] \SystemRoot\system32\DRIVERS\klif.sys [PAGE] ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\spoolsv.exe [1568:708] 000007fef45b10c8 Thread C:\Windows\System32\spoolsv.exe [1568:1556] 000007fef4576144 Thread C:\Windows\System32\spoolsv.exe [1568:2168] 000007fef4365fd0 Thread C:\Windows\System32\spoolsv.exe [1568:1540] 000007fef4353438 Thread C:\Windows\System32\spoolsv.exe [1568:1544] 000007fef43663ec Thread C:\Windows\System32\spoolsv.exe [1568:1552] 000007fef4895e5c Thread C:\Windows\system32\svchost.exe [2332:2400] 000007fefe54a808 Thread C:\Windows\system32\svchost.exe [2332:2272] 000007fef4206e5c Thread C:\Windows\system32\svchost.exe [2332:1548] 000007fef4205708 Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [5568:5420] 000007feecd9b6cc Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [5568:2588] 000007feecc5b62c Thread C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe [5568:5588] 000007feecc5b62c ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{536CB32E-971C-415C-8E41-8AA2E5E19F6B}\Connection@Name isatap.{17F32776-41C2-4FB4-B132-E1C2A7F30EC5} Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{C6A55BCE-C732-4D4D-8726-85B339A6CA28}\Connection@Name isatap.{910B4022-7007-4F80-9CEF-745423D79E1A} Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind \Device\{1FD384A1-3ADC-49E4-975F-A82001D9FA23}?\Device\{536CB32E-971C-415C-8E41-8AA2E5E19F6B}?\Device\{C6A55BCE-C732-4D4D-8726-85B339A6CA28}?\Device\{75F58320-7538-487C-A17C-3EB78E858C54}?\Device\{1BEFA710-E8B6-4756-93F9-B24A2314E704}?\Device\{994EADBA-8753-4C60-A1D2-2422AC95BFA2}? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route "{1FD384A1-3ADC-49E4-975F-A82001D9FA23}"?"{536CB32E-971C-415C-8E41-8AA2E5E19F6B}"?"{C6A55BCE-C732-4D4D-8726-85B339A6CA28}"?"{75F58320-7538-487C-A17C-3EB78E858C54}"?"{1BEFA710-E8B6-4756-93F9-B24A2314E704}"?"{994EADBA-8753-4C60-A1D2-2422AC95BFA2}"? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export \Device\TCPIP6TUNNEL_{1FD384A1-3ADC-49E4-975F-A82001D9FA23}?\Device\TCPIP6TUNNEL_{536CB32E-971C-415C-8E41-8AA2E5E19F6B}?\Device\TCPIP6TUNNEL_{C6A55BCE-C732-4D4D-8726-85B339A6CA28}?\Device\TCPIP6TUNNEL_{75F58320-7538-487C-A17C-3EB78E858C54}?\Device\TCPIP6TUNNEL_{1BEFA710-E8B6-4756-93F9-B24A2314E704}?\Device\TCPIP6TUNNEL_{994EADBA-8753-4C60-A1D2-2422AC95BFA2}? Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\84a6c8249239 Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{536CB32E-971C-415C-8E41-8AA2E5E19F6B}@InterfaceName isatap.{17F32776-41C2-4FB4-B132-E1C2A7F30EC5} Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{536CB32E-971C-415C-8E41-8AA2E5E19F6B}@ReusableType 0 Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{C6A55BCE-C732-4D4D-8726-85B339A6CA28}@InterfaceName isatap.{910B4022-7007-4F80-9CEF-745423D79E1A} Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{C6A55BCE-C732-4D4D-8726-85B339A6CA28}@ReusableType 0 Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Teredo\PreviousState\00-25-9c-b5-ea-16@ClientLocalPort 59425 Reg HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Teredo\PreviousState\00-25-9c-b5-ea-16@TeredoAddress 2001:0:5ef5:79fd:18ff:17de:a442:ff39 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\84a6c8249239 (not active ControlSet) ---- EOF - GMER 2.1 ----