GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-12-07 19:52:16
Windows 6.1.7600  \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 WDC_WD25 rev.01.0 232,89GB
Running: gmer.exe; Driver: C:\Users\Agnese\AppData\Local\Temp\kwdiqpow.sys


---- Kernel code sections - GMER 2.1 ----

.text  ntkrnlpa.exe!ZwSaveKeyEx + 13BD                                                                                        83298569 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                                 832BD092 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User code sections - GMER 2.1 ----

.text  C:\Program Files\Real\RealPlayer\Update\realsched.exe[2236] kernel32.dll!SetUnhandledExceptionFilter                   77393162 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text  C:\Program Files\Pando Networks\Media Booster\PMB.exe[2712] kernel32.dll!SetUnhandledExceptionFilter                   77393162 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- User IAT/EAT - GMER 2.1 ----

IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                                        [74602494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                                   [745E5624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                                  [745E56E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                                         [7460250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]                               [745F8573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                                 [745F4D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]                                [745F50CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]                               [745F51A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]                      [745F66D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]                                [745F82CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]                           [745F8819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]                         [745F907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]                               [745FE21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll
IAT    C:\Windows\Explorer.EXE[1648] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                                   [745F4C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00218600ddd9                                            
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00218600ddd9 (not active ControlSet)                        
Reg    HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-3345188048-2503292345-2761132505-1000@RefCount  4

---- EOF - GMER 2.1 ----