GMER 2.1.19081 - http://www.gmer.net Rootkit scan 2013-02-22 19:23:54 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST500LM0 rev.2AR1 465,76GB Running: i7qcxzqq.exe; Driver: C:\Users\Piotr\AppData\Local\Temp\awldrkow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1584] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 00000000765f87b1 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1584] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Program Files\ESET\ESET Smart Security\x86\ekrn.exe[1584] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1148] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3920] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe[3920] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 .text C:\Windows\SysWOW64\jmdp\stij.exe[4972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Windows\SysWOW64\jmdp\stij.exe[4972] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4708] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 .text C:\Program Files (x86)\NapiProjekt\napisy.exe[3464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076471465 2 bytes [47, 76] .text C:\Program Files (x86)\NapiProjekt\napisy.exe[3464] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000764714bb 2 bytes [47, 76] .text ... * 2 ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [2140:2500] 000007fef7fd9688 Thread [3980:1444] 0000000077382e25 Thread [3980:4764] 000000005003bf18 Thread [3980:5080] 0000000077383e45 Thread [3980:4752] 00000000710327c1 Thread [3980:3164] 0000000077383e45 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\9cb70d80454b Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\9cb70d80454b (not active ControlSet) ---- Files - GMER 2.1 ---- File C:\Users\Piotr\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BYD0WCHQ\clients[1].txt 1 bytes ---- EOF - GMER 2.1 ----