GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2017-07-07 18:28:12 Windows 6.1.7601 Service Pack 1 x64 Running: qydhnxjo.exe ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\avgRvrt\Parameters\Instup_14953953251133014@SetupOperations ???U?j???????:???:???????d???????n???j???:???????????2?2?2?:ve??? ???????,?????:?????;?,??????????@? ???????D0???????????_??????7C??? ???????:?????:???????0????????????????????? ???;???????????????????????:???:???:??? ???????:???????????:?0?????????????????????????:???????;???????p???????????:????,??;??????????????? ???????:?????:???????0????????????????????? ???????:???????????0?0????????,?????????????????????????????,??;???;???:?????;????????????????????????si???????????r???????????????????I???????????:?:?:?:?:?:?:?:?:?:ms??? ???????:????????????????L?????????????????????? ???????:???????????:??????????????&???????????????????????????????????? ???????:???????????:??????????????&???????????????????????????????????? ???:??????????d????:??? ???????:???????????:??????????????&??????????????????????????4?&?????:?????:??? ???:??????????d????:??? ???????:???????????:??????????????&???????????????????????? ???:??????????d????????????????:?????;?; ????????????????????????? ??????????? ??????????? ??????????? ?????? Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch 26116 Reg HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch 21745 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files (x86)\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x27 0xEA 0xBD 0x2B ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0xAA 0x73 0x10 0xCC ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xD9 0xB8 0x88 0xC4 ... Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters@DhcpNameServer 62.21.99.94 62.21.99.95 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{37D6D1BB-43C6-46AB-9D33-F1353BE37A81}@LeaseObtainedTime 1499444196 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{37D6D1BB-43C6-46AB-9D33-F1353BE37A81}@T1 1499444323 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{37D6D1BB-43C6-46AB-9D33-F1353BE37A81}@T2 1499444419 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{37D6D1BB-43C6-46AB-9D33-F1353BE37A81}@LeaseTerminatesTime 1499444451 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@Lease 604800 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@LeaseObtainedTime 1499444070 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@T1 1499746470 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@T2 1499973270 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@LeaseTerminatesTime 1500048870 Reg HKLM\SYSTEM\CurrentControlSet\services\Tcpip\Parameters\Interfaces\{ED8A948E-1BE7-42DC-AB71-E6103F55F735}@DhcpNameServer 62.21.99.94 62.21.99.95 Reg HKLM\SYSTEM\ControlSet002\services\avgRvrt\Parameters\Instup_14953953251133014@SetupOperations ????e????????????????????????k??VF0530 Live! Cam Chat IM?????????????????????????????N??if??USB\VID_041E&PID_406B&REV_8314&MI_00?USB\VID_041E&PID_406B&MI_00????USB\Class_0e&SubClass_03&Prot_00?USB\Class_0e&SubClass_03?USB\Class_0e??\P???????????5?????t????elper????????????.??????????????)?????N?????????????????0000.0014.0000.005.000.000.000.000.000?_PP???????????z??????????????r??????????????????????????????????t?????????????5???????????????????{???????????????????m???????/???????????????????????????9??????????????????????????????OR???????????9?????t1.??????????????????Commited?????????????????????????????????u???????????d??????????????????????DiskDrive???@volsnap.inf,%storage\volumesnapshot.devicedesc%;Rodzajowa kopia w tle wolumin?w??????????????????????????????????R????????????e????????????VolumeSnapshot???????????????e???????????????9??fb??????????????????????????????????? ???k??????????????????????????????????????@volsnap.inf,%storage\volumesnapshot.devicedesc%;Rodzajowa kopia w tle wolumin?w??????????? Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@p0 C:\Program Files (x86)\Alcohol Soft\Alcohol 120\ Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04@ujdew 0x27 0xEA 0xBD 0x2B ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001@ujdew 0xAA 0x73 0x10 0xCC ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\0D79C293C1ED61418462E24595C90D04\00000001\jdgg40@ujdew 0xD9 0xB8 0x88 0xC4 ... ---- EOF - GMER 2.2 ----