GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-10-14 11:35:22
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\0000006e ADATA___ rev.5.2. 59,63GB
Running: mrbe7bfl.exe; Driver: C:\Users\Tomek\AppData\Local\Temp\kwddykog.sys


---- User code sections - GMER 2.1 ----

.text  C:\Windows\SysWOW64\PnkBstrA.exe[1388] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82                                00000000726517fa 2 bytes CALL 74f211a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1388] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88                            0000000072651860 2 bytes CALL 74f211a9 C:\Windows\syswow64\kernel32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1388] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98                          0000000072651942 2 bytes JMP 76707089 C:\Windows\syswow64\WS2_32.dll
.text  C:\Windows\SysWOW64\PnkBstrA.exe[1388] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109                         000000007265194d 2 bytes JMP 7670cba6 C:\Windows\syswow64\WS2_32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      0000000076261401 2 bytes JMP 74f4b20b C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        0000000076261419 2 bytes JMP 74f4b336 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      0000000076261431 2 bytes JMP 74fc8f39 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      000000007626144a 2 bytes CALL 74f24885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                             * 9
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000762614dd 2 bytes JMP 74fc8832 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000762614f5 2 bytes JMP 74fc8a08 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         000000007626150d 2 bytes JMP 74fc8728 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  0000000076261525 2 bytes JMP 74fc8af2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        000000007626153d 2 bytes JMP 74f3fc98 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             0000000076261555 2 bytes JMP 74f468df C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      000000007626156d 2 bytes JMP 74fc8ff1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        0000000076261585 2 bytes JMP 74fc8b52 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           000000007626159d 2 bytes JMP 74fc86ec C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000762615b5 2 bytes JMP 74f3fd31 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000762615cd 2 bytes JMP 74f4b2cc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000762616b2 2 bytes JMP 74fc8eb4 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Skype\Phone\Skype.exe[4376] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000762616bd 2 bytes JMP 74fc8681 C:\Windows\syswow64\kernel32.dll

---- Disk sectors - GMER 2.1 ----

Disk   \Device\Harddisk0\DR0                                                                                           unknown MBR code

---- EOF - GMER 2.1 ----