GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2014-01-15 22:41:42 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK1652GSX rev.LV011C 149,05GB Running: 8z4k6koe.exe; Driver: C:\Users\CIAPRO~1\AppData\Local\Temp\kxddqpoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Windows\SysWOW64\NOTEPAD.EXE[3612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075721465 2 bytes [72, 75] .text C:\Windows\SysWOW64\NOTEPAD.EXE[3612] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000757214bb 2 bytes [72, 75] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [816:1552] 000007fef84120c0 Thread C:\Windows\System32\svchost.exe [816:328] 000007fef83d14a0 Thread C:\Windows\System32\svchost.exe [816:1796] 000007fef84126a8 Thread C:\Windows\System32\svchost.exe [816:1800] 000007fef84129dc Thread C:\Windows\System32\svchost.exe [816:4008] 000007fef91744e0 Thread C:\Windows\system32\svchost.exe [844:1612] 000007fef8820ea8 Thread C:\Windows\system32\svchost.exe [844:1704] 000007fef8819db0 Thread C:\Windows\system32\svchost.exe [844:636] 000007fef881aa10 Thread C:\Windows\system32\svchost.exe [844:2052] 000007fef8821c94 Thread C:\Windows\system32\svchost.exe [844:3696] 000007fef230d3c8 Thread C:\Windows\system32\svchost.exe [844:3700] 000007fef230d3c8 Thread C:\Windows\system32\svchost.exe [844:3704] 000007fef230d3c8 Thread C:\Windows\system32\svchost.exe [844:3708] 000007fef230d3c8 Thread C:\Windows\System32\svchost.exe [292:1032] 000007fefa58341c Thread C:\Windows\System32\svchost.exe [292:1036] 000007fefa583a2c Thread C:\Windows\System32\svchost.exe [292:1040] 000007fefa585c20 Thread C:\Windows\System32\svchost.exe [292:1044] 000007fefa583768 Thread C:\Windows\System32\svchost.exe [292:1056] 000007fefa97bec4 Thread C:\Windows\System32\svchost.exe [292:1708] 000007fef93283d8 Thread C:\Windows\System32\svchost.exe [292:1712] 000007fef93283d8 Thread C:\Windows\System32\svchost.exe [292:1868] 000007fef8b23f1c Thread C:\Windows\System32\svchost.exe [292:1900] 000007fef8ad22b8 Thread C:\Windows\System32\svchost.exe [292:1904] 000007fef8ad1a38 Thread C:\Windows\System32\svchost.exe [292:1908] 000007fef87b5388 Thread C:\Windows\System32\svchost.exe [292:1912] 000007fef8797738 Thread C:\Windows\System32\svchost.exe [292:1916] 000007fef8781f90 Thread C:\Windows\System32\svchost.exe [292:2240] 000007fef6c85170 Thread C:\Windows\System32\svchost.exe [292:3092] 000007fefa583900 Thread C:\Windows\System32\svchost.exe [292:3372] 000007fefa515124 Thread C:\Windows\system32\svchost.exe [2896:2160] 000000007421b5fc Thread C:\Windows\system32\svchost.exe [2896:2164] 0000000072e78b1c Thread C:\Windows\system32\svchost.exe [2896:2204] 0000000072e7c740 Thread C:\Windows\system32\svchost.exe [2896:1464] 0000000072e8498c Thread C:\Windows\system32\svchost.exe [2896:2216] 00000000741d2234 Thread C:\Windows\system32\svchost.exe [2896:2248] 0000000074240398 Thread C:\Windows\system32\svchost.exe [2896:2276] 0000000074321760 Thread C:\Windows\system32\svchost.exe [2896:2368] 0000000074216394 Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3732:1368] 000007fefb812a7c Thread C:\Program Files\Windows Media Player\wmpnetwk.exe [3732:1484] 000007fef3e9d618 ---- EOF - GMER 2.1 ----