GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-30 15:41:06
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0011 465,76GB
Running: gmer.exe; Driver: C:\Users\Iwka\AppData\Local\Temp\ffrcqaod.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                                                                  00000000753087b1 4 bytes [C2, 04, 00, 00]
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                                                                       00000000765f1465 2 bytes [5F, 76]
.text   C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[1868] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                                                                      00000000765f14bb 2 bytes [5F, 76]
.text   ...                                                                                                                                                                                         * 2
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        00000000765f1465 2 bytes [5F, 76]
.text   C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[1152] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000765f14bb 2 bytes [5F, 76]
.text   ...                                                                                                                                                                                         * 2
?       C:\Windows\system32\mssprxy.dll [2740] entry point in ".rdata" section                                                                                                                      0000000070fa71e6
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                        00000000765f1465 2 bytes [5F, 76]
.text   C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3404] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                       00000000765f14bb 2 bytes [5F, 76]
.text   ...                                                                                                                                                                                         * 2
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                00000000765f1465 2 bytes [5F, 76]
.text   C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe[3876] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                               00000000765f14bb 2 bytes [5F, 76]
.text   ...                                                                                                                                                                                         * 2
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                      00000000765f1465 2 bytes [5F, 76]
.text   C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3268] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                     00000000765f14bb 2 bytes [5F, 76]
.text   ...                                                                                                                                                                                         * 2

---- Threads - GMER 2.1 ----

Thread   [5060:5884]                                                                                                                                                                                00000000775f2e25
Thread   [5060:3380]                                                                                                                                                                                00000000775f3e45
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [5592:5672]                                                                                                                              000007fefb532a7c
Thread  C:\Program Files\Windows Media Player\wmpnetwk.exe [5592:5680]                                                                                                                              000007feed1fd618

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\446d57e57904                                                                                                                 
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\446d57e57904 (not active ControlSet)                                                                                             

---- Files - GMER 2.1 ----

File    C:\SysPart\Boot?                                                                                                                                                                            0 bytes
File    C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking\ab239fd9e486000ff99232c7b2ca856abe6b12dd.HomeGroupClassifier\b3413fc75f4ae173c215b55bdb234d24\grouping\edb000B1.log  262144 bytes
File    C:\Windows\ServiceProfiles\LocalService\AppData\Roaming\PeerNetworking\ab239fd9e486000ff99232c7b2ca856abe6b12dd.HomeGroupClassifier\b3413fc75f4ae173c215b55bdb234d24\grouping\tmp.edb       65536 bytes

---- EOF - GMER 2.1 ----