GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-06-05 21:36:10 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000071 ST1000DM rev.CC45 931,51GB Running: r0o1kmbc.exe; Driver: C:\Users\kombajn\AppData\Local\Temp\ugdiafog.sys ---- User code sections - GMER 2.2 ---- .text C:\Windows\SysWOW64\PnkBstrA.exe[1900] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072a81a22 2 bytes [A8, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1900] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072a81ad0 2 bytes [A8, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1900] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072a81b08 2 bytes [A8, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1900] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072a81bba 2 bytes [A8, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1900] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072a81bda 2 bytes [A8, 72] .text C:\Program Files (x86)\NVIDIA Corporation\Update Core\NvBackend.exe[2108] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076481bb2 5 bytes JMP 0000000000313610 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\kernel32.dll!CreateFileW 00000000764d3f5c 13 bytes JMP 00000000658aaf40 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!SetWindowPos 000000007571cdb4 5 bytes JMP 00000000658aadb0 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!ShowWindow 0000000075720dbe 5 bytes JMP 00000000658aac10 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!SetFocus 0000000075721b99 5 bytes JMP 00000000658aacf0 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!SetForegroundWindow 0000000075721d34 13 bytes JMP 00000000658aa8f0 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!SetActiveWindow 0000000075722890 5 bytes JMP 00000000658aae80 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!BringWindowToTop 0000000075727ba7 13 bytes JMP 00000000658aa9b0 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!SwitchToThisWindow 000000007575908c 13 bytes JMP 00000000658aaa70 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\USER32.dll!ShowWindowAsync 0000000075777f27 5 bytes JMP 00000000658aab30 .text C:\Program Files (x86)\Origin\Origin.exe[2164] C:\Windows\syswow64\ole32.dll!DoDragDrop 0000000076d4a827 13 bytes JMP 00000000658aa830 ---- Threads - GMER 2.2 ---- Thread C:\Windows\System32\svchost.exe [552:1392] 000007fef9e659a0 Thread C:\Windows\System32\svchost.exe [552:2504] 000007fefce61a70 Thread C:\Windows\System32\svchost.exe [552:2808] 000007fef6d020c0 Thread C:\Windows\System32\svchost.exe [552:2816] 000007fef6d026a8 Thread C:\Windows\System32\svchost.exe [552:2968] 000007fef6d029dc Thread C:\Windows\System32\svchost.exe [552:2984] 000007fef6d029dc Thread C:\Windows\System32\svchost.exe [552:2988] 000007fef6d029dc Thread C:\Windows\System32\svchost.exe [552:4516] 000007fef7d544e0 Thread C:\Windows\System32\svchost.exe [552:4908] 000007fef85288f8 Thread C:\Windows\system32\svchost.exe [460:1444] 000007fef9a91e00 Thread C:\Windows\system32\svchost.exe [460:1472] 000007fef9951a50 Thread C:\Windows\system32\svchost.exe [460:2376] 000007fefce61a70 Thread C:\Windows\system32\svchost.exe [460:836] 000007feeee9506c Thread C:\Windows\system32\svchost.exe [460:1600] 000007fef5ed1c20 Thread C:\Windows\system32\svchost.exe [460:1536] 000007fef5ed1c20 Thread C:\Windows\system32\svchost.exe [460:5808] 000007fef5c11ab0 Thread C:\Windows\system32\svchost.exe [460:8380] 000007fef75c17f8 Thread C:\Windows\system32\svchost.exe [460:248] 000007fef75c17f8 Thread C:\Windows\system32\AUDIODG.EXE [1060:3060] 00000000702869d0 Thread C:\Windows\system32\AUDIODG.EXE [1060:1308] 0000000070286c38 Thread C:\Windows\system32\AUDIODG.EXE [1060:6948] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6952] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6372] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6480] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6696] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6872] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5880] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6176] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6440] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4720] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6536] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5660] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6608] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6512] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6520] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5868] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4844] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7104] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:936] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:2664] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:2336] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6908] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6968] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6676] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:1852] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4972] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6376] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6532] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:744] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7096] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7160] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6936] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6616] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:2356] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6508] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5364] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6648] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7112] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6844] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7088] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4712] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7084] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:1324] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5872] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5648] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:816] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6780] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:1624] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4520] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6920] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5068] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6856] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6472] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4544] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:896] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6728] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6752] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5512] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:1224] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5116] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6324] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6544] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6712] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6688] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4304] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6528] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5780] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6496] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:3088] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6736] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5676] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4332] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6612] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:2852] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6832] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:3240] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6924] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5436] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:1676] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6692] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5696] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5644] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5476] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:1332] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7140] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6384] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7136] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5376] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8076] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8080] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7676] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6356] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7416] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7868] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7732] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4740] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7216] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4656] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7888] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7900] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7608] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6468] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7432] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6928] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7260] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8036] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8164] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8124] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7492] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8048] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7496] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7100] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6976] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8180] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7568] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7988] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:3132] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7376] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:800] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7536] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7840] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7252] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5016] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8148] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6812] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7916] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7788] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6256] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7436] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:3112] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6064] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8000] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4788] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5236] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5012] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7852] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8096] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6744] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:3416] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:916] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7712] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:1988] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7408] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7428] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8144] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8104] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5224] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6252] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7820] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6680] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7924] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8140] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7548] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5480] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7816] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5396] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6904] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5472] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:2992] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7964] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7564] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:3204] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8152] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:2752] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7272] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6932] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6024] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:4540] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8092] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:796] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7636] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7560] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7528] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6836] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7672] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7688] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7524] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7236] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7552] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7520] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:760] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5212] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7980] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7860] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6888] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:2920] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5196] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7848] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7876] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:3996] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:6880] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7116] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7224] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6148] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7348] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7484] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7940] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:5100] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:4124] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7884] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7540] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7704] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7472] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7696] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:5524] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6776] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:1452] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:6564] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8236] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8240] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8488] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8492] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8580] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7468] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8808] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7624] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8796] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:9084] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7764] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8596] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8800] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7592] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8500] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7724] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8560] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8972] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7316] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8644] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:8408] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8312] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7364] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:7048] 000000007029f308 Thread C:\Windows\system32\AUDIODG.EXE [1060:7720] 000000007029f0e4 Thread C:\Windows\system32\AUDIODG.EXE [1060:8416] 000000007029f308 Thread C:\Windows\system32\svchost.exe [1100:4624] 000007fef0ccd3c8 Thread C:\Windows\system32\svchost.exe [1100:4628] 000007fef0ccd3c8 Thread C:\Windows\system32\svchost.exe [1100:4632] 000007fef0ccd3c8 Thread C:\Windows\system32\svchost.exe [1100:4636] 000007fef0ccd3c8 Thread C:\Windows\system32\svchost.exe [1100:1136] 000007feeeacb1b0 Thread C:\Windows\system32\svchost.exe [1100:5488] 000007fef5846848 Thread C:\Windows\system32\svchost.exe [1188:1804] 000007fef93dbec4 Thread C:\Windows\system32\svchost.exe [1188:2592] 000007fef8f75124 Thread C:\Windows\system32\svchost.exe [1188:4268] 000007fef1ea5170 Thread C:\Windows\System32\spoolsv.exe [1496:1568] 000007fef82f10c8 Thread C:\Windows\System32\spoolsv.exe [1496:1588] 000007fef82b6144 Thread C:\Windows\System32\spoolsv.exe [1496:1768] 000007fef80a5fd0 Thread C:\Windows\System32\spoolsv.exe [1496:1776] 000007fef8093438 Thread C:\Windows\System32\spoolsv.exe [1496:1704] 000007fef80a63ec Thread C:\Windows\System32\spoolsv.exe [1496:1884] 000007fef8385e5c Thread C:\Windows\System32\spoolsv.exe [1496:1896] 000007fef83b5090 Thread C:\Windows\system32\svchost.exe [3012:3448] 000007fef6565ec0 Thread C:\Windows\system32\svchost.exe [3012:4596] 000007fef80a5fd0 Thread C:\Windows\system32\svchost.exe [3012:4600] 000007fef80a63ec ---- EOF - GMER 2.2 ----