GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-11-16 11:03:16
Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 SAMSUNG_HD322HJ rev.1AC01118 298,09GB
Running: gmer.exe; Driver: C:\Users\Umud\AppData\Local\Temp\ufldapow.sys
---- Kernel code sections - GMER 2.1 ----
.text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000166700 15 bytes [40, B5, F7, 01, 80, 39, 70, ...]
.text C:\Windows\System32\win32k.sys!W32pServiceTable + 16 fffff96000166710 11 bytes [00, 15, FC, FF, 00, 27, C3, ...]
---- User code sections - GMER 2.1 ----
.text C:\Windows\system32\atiesrxx.exe[80] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6895169a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atiesrxx.exe[80] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff689516a2 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atiesrxx.exe[80] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6895181a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atiesrxx.exe[80] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff68951832 4 bytes [95, 68, FF, 7F]
.text C:\Windows\System32\spoolsv.exe[1316] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6895169a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\System32\spoolsv.exe[1316] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff689516a2 4 bytes [95, 68, FF, 7F]
.text C:\Windows\System32\spoolsv.exe[1316] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6895181a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\System32\spoolsv.exe[1316] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff68951832 4 bytes [95, 68, FF, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1816] C:\Windows\system32\psapi.dll!GetModuleBaseNameA + 506 00007fff6895169a 4 bytes [95, 68, FF, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1816] C:\Windows\system32\psapi.dll!GetModuleBaseNameA + 514 00007fff689516a2 4 bytes [95, 68, FF, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1816] C:\Windows\system32\psapi.dll!QueryWorkingSet + 118 00007fff6895181a 4 bytes [95, 68, FF, 7F]
.text C:\Program Files\Windows Defender\MsMpEng.exe[1816] C:\Windows\system32\psapi.dll!QueryWorkingSet + 142 00007fff68951832 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atieclxx.exe[6000] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 506 00007fff6895169a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atieclxx.exe[6000] C:\Windows\system32\PSAPI.DLL!GetModuleBaseNameA + 514 00007fff689516a2 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atieclxx.exe[6000] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 118 00007fff6895181a 4 bytes [95, 68, FF, 7F]
.text C:\Windows\system32\atieclxx.exe[6000] C:\Windows\system32\PSAPI.DLL!QueryWorkingSet + 142 00007fff68951832 4 bytes [95, 68, FF, 7F]
---- Threads - GMER 2.1 ----
Thread C:\Windows\System32\spoolsv.exe [1316:4696] 00007fff5fb112f8
Thread C:\Windows\System32\spoolsv.exe [1316:4700] 00007fff5faf3118
Thread C:\Windows\System32\spoolsv.exe [1316:4784] 00007fff5363d020
Thread C:\Windows\system32\svchost.exe [1340:1596] 00007fff616b2b90
Thread C:\Windows\system32\svchost.exe [1340:1152] 00007fff616b67bc
Thread C:\Windows\system32\svchost.exe [1340:2072] 00007fff5f874608
Thread C:\Windows\system32\svchost.exe [1340:2212] 00007fff5dbb2110
Thread C:\Windows\system32\svchost.exe [1340:2216] 00007fff5db81584
Thread C:\Windows\system32\svchost.exe [1340:2636] 00007fff5bcb1b40
Thread C:\Windows\system32\svchost.exe [1340:4052] 00007fff5f871040
Thread C:\Windows\system32\svchost.exe [1340:5296] 00007fff5eec4b30
Thread C:\Windows\system32\csrss.exe [3616:6128] fffff96000980b90
---- Processes - GMER 2.1 ----
Process C:\Users\Umud\AppData\Local\Skillbrains\lightshot\5.1.4.17\Lightshot.exe (*** suspicious ***) @ C:\Users\Umud\AppData\Local\Skillbrains\lightshot\5.1.4.17\Lightshot.exe [1088] (Lightshot/Skillbrains)(2014-10-08 16:44:37) 00000000012d0000
Library C:\Users\Umud\AppData\Local\Skillbrains\lightshot\5.1.4.17\Lightshot.dll (*** suspicious ***) @ C:\Users\Umud\AppData\Local\Skillbrains\lightshot\5.1.4.17\Lightshot.exe [1088] (LightshotDll/Skillbrains)(2014-10-08 16:44:36) 0000000074710000
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
