GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-12-08 20:24:27 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\00000032 Samsung_SSD_840_PRO_Series rev.DXM05B0Q 238.47GB Running: 7dicy0vn.exe; Driver: C:\Users\Hubert\AppData\Local\Temp\pxtcqpog.sys ---- User code sections - GMER 2.1 ---- .text C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\dwm.exe[984] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\nvvsvc.exe[336] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\nvvsvc.exe[336] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\nvvsvc.exe[336] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\system32\nvvsvc.exe[336] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcaupdate\update.exe[1788] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcaupdate\update.exe[1788] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcaupdate\update.exe[1788] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcaupdate\update.exe[1788] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\Explorer.EXE[3772] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\Explorer.EXE[3772] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\Explorer.EXE[3772] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\WINDOWS\Explorer.EXE[3772] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\Windows\System32\igfxpers.exe[4556] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\Windows\System32\igfxpers.exe[4556] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\Windows\System32\igfxpers.exe[4556] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\Windows\System32\igfxpers.exe[4556] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff85af61f6a 4 bytes [F6, 5A, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff85af61f82 4 bytes [F6, 5A, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\ArcaVir\AVMenu.exe[4596] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[4844] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff85af61f6a 4 bytes [F6, 5A, F8, 7F] .text C:\Program Files\Windows Media Player\wmpnetwk.exe[4844] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff85af61f82 4 bytes [F6, 5A, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007ff86870169a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007ff8687016a2 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 118 00007ff86870181a 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\system32\PSAPI.DLL!QueryWorkingSet + 142 00007ff868701832 4 bytes [70, 68, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 194 00007ff85af61f6a 4 bytes [F6, 5A, F8, 7F] .text C:\Program Files\Arcabit\arcavir\arcamainsv.exe[4820] C:\WINDOWS\SYSTEM32\WSOCK32.dll!setsockopt + 218 00007ff85af61f82 4 bytes [F6, 5A, F8, 7F] ---- Threads - GMER 2.1 ---- Thread C:\WINDOWS\system32\csrss.exe [636:660] fffff960008afb90 Thread C:\WINDOWS\system32\svchost.exe [1312:2868] 00007ff85b0a1584 Thread C:\WINDOWS\system32\svchost.exe [1312:2896] 00007ff85b061b40 Thread C:\WINDOWS\system32\svchost.exe [1312:2792] 00007ff85aba4608 Thread C:\WINDOWS\system32\svchost.exe [1312:1236] 00007ff85baf7420 Thread C:\WINDOWS\system32\svchost.exe [1312:1648] 00007ff85aba1040 Thread C:\WINDOWS\system32\taskhost.exe [5100:4468] 00007ff85d5d1a90 ---- Processes - GMER 2.1 ---- Process C:\ProgramData\DatacardService\HWDeviceService64.exe (*** suspicious ***) @ C:\ProgramData\DatacardService\HWDeviceService64.exe [4988](2010-11-16 13:38:16) 00007ff62c850000 Process C:\ProgramData\DatacardService\DCSHelper.exe (*** suspicious ***) @ C:\ProgramData\DatacardService\DCSHelper.exe [3940] (DataCardMonitor MFC Application/Huawei Technologies Co., Ltd.)(2010-11-16 13:37:30) 0000000000400000 Process C:\Users\Hubert\AppData\Roaming\PLAY ONLINE\ouc.exe (*** suspicious ***) @ C:\Users\Hubert\AppData\Roaming\PLAY ONLINE\ouc.exe [4032] (Online Update Clinet/Huawei Technologies Co., Ltd.)(2014-09-15 20:47:48) 0000000000400000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime 0xC2 0x4D 0xAF 0x1F ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFStartTime 0xC2 0x4D 0xAF 0x1F ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@CMFLastStartTime 0x4F 0x0B 0xBD 0xBF ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime 0xD7 0xA8 0xBA 0xBF ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@pl-PL 24 Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM579116843009_01_07D9_BF^FE02A2BADA5FBE83D448EC2D9270A8FD@Timestamp 0xE4 0x94 0xEC 0xC3 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid 736 Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@AbNDIS Miniport 1?2?3? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@WAN Miniport (SSTP) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Miniport WAN (PPTP) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@WAN Miniport (IPv6) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Miniport WAN (PPPOE) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@WAN Miniport (IP) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Miniport WAN (L2TP) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@Miniport WAN (IKEv2) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\Descriptions@WAN Miniport (Network Monitor) 1? Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager@PendingFileRenameOperations \??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp\Au_.exe??\??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp??\??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp\Au_.exe??\??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp??\??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp\Au_.exe??\??\C:\Users\Hubert\AppData\Local\Temp\~nsu.tmp??\??\C:\Program Files (x86)\OrangeBusinessServices\Manager po??cze?\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\UserGuide_PL.pdf?? Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber 4521597 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed -1208440875 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId 27 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime 429381522 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime 11664 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime 10744 Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID 7222e994-fd40-4890-88f5-63b6f5f Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@GlassSessionId 3 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog@FileCounter 3 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger@FileCounter 7 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter 3 Reg HKLM\SYSTEM\CurrentControlSet\Enum@NextParentID.36a2786b.7 2 Reg HKLM\SYSTEM\CurrentControlSet\Services\ABndis\Parameters\Adapters\NdisWanBh@UpperBindings \Device\{A2358C0F-EA60-4A21-B92A-FCCAD10B61FB} Reg HKLM\SYSTEM\CurrentControlSet\Services\ABndis\Parameters\Adapters\NdisWanIp@UpperBindings \Device\{6F22BE98-CC14-451D-AD43-8F7AD235300B} Reg HKLM\SYSTEM\CurrentControlSet\Services\ABndis\Parameters\Adapters\NdisWanIpv6@UpperBindings \Device\{F17FC8AF-7A7D-4CB9-A3C8-D4E63936C2F3} Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Linkage@Bind \Device\Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetbiosSmb?\Device\NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Linkage@Route "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"NetbiosSmb"?"NetBT" "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"NetBT" "Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanServer\Linkage@Export \Device\LanmanServer_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanServer_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanServer_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanServer_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanServer_NetbiosSmb?\Device\LanmanServer_NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanServer_NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanServer_NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanServer_NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage@Bind \Device\Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetbiosSmb?\Device\NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage@Route "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"NetbiosSmb"?"NetBT" "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"NetBT" "Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\LanmanWorkstation\Linkage@Export \Device\LanmanWorkstation_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanWorkstation_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanWorkstation_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanWorkstation_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanWorkstation_NetbiosSmb?\Device\LanmanWorkstation_NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanWorkstation_NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\LanmanWorkstation_NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\LanmanWorkstation_NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\Ndisuio\Linkage@Bind \Device\{E129EE96-4378-46D4-A856-5B807457B808}?\Device\{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\Ndisuio\Linkage@Route "{E129EE96-4378-46D4-A856-5B807457B808}"?"{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\Ndisuio\Linkage@Export \Device\Ndisuio_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Ndisuio_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NdisWan\Linkage@Bind \Device\{CF6D96A9-FC8A-4E06-B971-13850C3F7790}?\Device\{A9187A7D-F21C-41BB-B056-F5A217FCC468}?\Device\{A52E11F2-F4D9-497D-9DE5-C68641D4BD99}?\Device\{3736A8BE-DB71-45C5-871B-FA9E5A808339}?\Device\{8B3E1078-44CB-44B7-9735-0B664D4D37D2}?\Device\{E36E1C2D-76BE-4683-BF3B-49B83B76C42D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NdisWan\Linkage@Route "{CF6D96A9-FC8A-4E06-B971-13850C3F7790}"?"{A9187A7D-F21C-41BB-B056-F5A217FCC468}"?"{A52E11F2-F4D9-497D-9DE5-C68641D4BD99}"?"{3736A8BE-DB71-45C5-871B-FA9E5A808339}"?"{8B3E1078-44CB-44B7-9735-0B664D4D37D2}"?"{E36E1C2D-76BE-4683-BF3B-49B83B76C42D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\NdisWan\Linkage@Export \Device\NdisWan_{CF6D96A9-FC8A-4E06-B971-13850C3F7790}?\Device\NdisWan_{A9187A7D-F21C-41BB-B056-F5A217FCC468}?\Device\NdisWan_{A52E11F2-F4D9-497D-9DE5-C68641D4BD99}?\Device\NdisWan_{3736A8BE-DB71-45C5-871B-FA9E5A808339}?\Device\NdisWan_{8B3E1078-44CB-44B7-9735-0B664D4D37D2}?\Device\NdisWan_{E36E1C2D-76BE-4683-BF3B-49B83B76C42D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage@Bind \Device\NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage@Route "NetBT" "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"NetBT" "Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"NetBT" "Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBIOS\Linkage@Export \Device\NetBIOS_NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBIOS_NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetBIOS_NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBIOS_NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBIOS\Parameters@MaxLana 3 Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Linkage@Bind \Device\Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Linkage@Route "Tcpip" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip" "{8718928D-CBEB-45EA-A621-800A9249001D}"?"Tcpip6" "{E129EE96-4378-46D4-A856-5B807457B808}"?"Tcpip6" "{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\NetBT\Linkage@Export \Device\NetBT_Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}?\Device\NetBT_Tcpip6_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\NetBT_Tcpip6_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\2@InterfaceName {E129EE96-4378-46D4-A856-5B807457B808} Reg HKLM\SYSTEM\CurrentControlSet\Services\RemoteAccess\Interfaces\3@InterfaceName {8718928D-CBEB-45EA-A621-800A9249001D} Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 2508 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 666 Reg HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence 26 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage@Bind \Device\{E129EE96-4378-46D4-A856-5B807457B808}?\Device\{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage@Route "{E129EE96-4378-46D4-A856-5B807457B808}"?"{8718928D-CBEB-45EA-A621-800A9249001D}"? Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Linkage@Export \Device\Tcpip_{E129EE96-4378-46D4-A856-5B807457B808}?\Device\Tcpip_{8718928D-CBEB-45EA-A621-800A9249001D}? Reg HKLM\SYSTEM\CurrentControlSet\Services\WANARP\Linkage@Bind \Device\NdisWanIp? Reg HKLM\SYSTEM\CurrentControlSet\Services\WANARP\Linkage@Route "NdisWanIp"? Reg HKLM\SYSTEM\CurrentControlSet\Services\WANARP\Linkage@Export \Device\Wanarp_NdisWanIp? Reg HKLM\SYSTEM\CurrentControlSet\Services\Wanarpv6\Linkage@Bind \Device\NdisWanIpv6? Reg HKLM\SYSTEM\CurrentControlSet\Services\Wanarpv6\Linkage@Route "NdisWanIpv6"? Reg HKLM\SYSTEM\CurrentControlSet\Services\Wanarpv6\Linkage@Export \Device\Wanarpv6_NdisWanIpv6? Reg HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop 0 Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@Rw 0x64 0x62 0x03 0x00 ... Reg HKLM\SYSTEM\Setup\Upgrade\NsiMigrationRoot\60\0@RwMask 0x64 0x62 0x03 0x00 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume{db965c43-7f09-11e4-be7d-001e101ff4df} Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume{db965c43-7f09-11e4-be7d-001e101ff4df}@Drive Type 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\Drives\Volume{db965c43-7f09-11e4-be7d-001e101ff4df}@IsImapiDataBurnSupported 0 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo\Volume{db965c43-7f09-11e4-be7d-001e101ff4df}@Active 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\CD Burning\StagingInfo\Volume{db965c43-7f09-11e4-be7d-001e101ff4df}@DriveNumber 5 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Taskband@FavoritesRemovedChanges 14 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@PolicyDocumentLastRefresh 0x56 0x15 0x96 0xC0 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsRequestBucketDrainTime 0x4E 0x6F 0x8B 0xC4 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastWindowsLargeRequestBucketDrainTime 0x4E 0x6F 0x8B 0xC4 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastOtherRequestBucketDrainTime 0x4E 0x6F 0x8B 0xC4 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@LastGlobalRequestBucketDrainTime 0x4E 0x6F 0x8B 0xC4 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@RoamingSyncToken LM%3d63553590791873%3bID%3dBF7AEFE7647B26BB!108%3bLR%3d63553590791097%3bEP%3d4%3bTD%3dTrue%3bSO%3d0 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@CloudSettingsDirtyMarks 3 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@CloudUsertileDirtyMarks 3 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\PolicyData@PolicyDocumentPollInterval 60 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastRenewCollectionsInterest 0x3A 0xF5 0x96 0x97 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Live\Roaming\RegistrarData@LastDownloadCollectionInterest 0xDC 0xCC 0xEC 0xC8 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce@Application Restart #0 C:\Windows\System32\StikyNot.exe /restart Reg HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive\Subscriptions@Scenario-2-BF7AEFE7647B26BB!101 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\SkyDrive\Subscriptions@Scenario-1-BF7AEFE7647B26BB!101 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Store@LastTileRefresh 0x44 0x90 0x94 0xB7 ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Store\RefreshBannedAppList@BannedAppsLastModified 0x80 0x7A 0xA1 0x9A ... Reg HKCU\Software\Microsoft\Windows\CurrentVersion\UFH\SHC@2 C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Manager po??cze?\Manager po??cze?.lnk?C:\Program Files (x86)\OrangeBusinessServices\Manager po??cze?\{ad30a369-08e3-414c-9d2c-7f47dbe748da}\BusinessEverywhere.exe?? Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@DisplayName ALLPlayer.TV Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@Comments ALLPlayer.TV Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@Publisher api.allplayer.nextplus.pl Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@DisplayIcon C:\Users\Hubert\AppData\Local\Microsoft\Silverlight\OutOfBrowser\3819847059.api.allplayer.nextplus.pl\3819847059.api.allplayer.nextplus.pl.ico Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@InstallLocation C:\Users\Hubert\AppData\Local\Microsoft\Silverlight\OutOfBrowser\3819847059.api.allplayer.nextplus.pl Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@NoRepair 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@NoModify 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Uninstall\3819847059.api.allplayer.nextplus.pl@UninstallString C:\Program Files (x86)\Microsoft Silverlight\5.1.30214.0\Silverlight.Configuration.exe -uninstallApp 3819847059.api.allplayer.nextplus.pl Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation C:\Users\Hubert\AppData\Local\Microsoft\Windows\WER\ReportQueue\NonCritical_x64_cc95398c43c986dc74d74a45653a94fb8c72587_00000000_cab_077ef59f ---- EOF - GMER 2.1 ----