GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-06-14 23:31:19 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.0003 465,76GB Running: 8vk5eyte.exe; Driver: C:\Users\A&A\AppData\Local\Temp\fxldapow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1456] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000760d1465 2 bytes [0D, 76] .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[1456] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000760d14bb 2 bytes [0D, 76] .text ... * 2 .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 322 0000000072221a22 2 bytes [22, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 496 0000000072221ad0 2 bytes [22, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 552 0000000072221b08 2 bytes [22, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 730 0000000072221bba 2 bytes [22, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 762 0000000072221bda 2 bytes [22, 72] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000760d1465 2 bytes [0D, 76] .text C:\Windows\SysWOW64\PnkBstrA.exe[1416] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760d14bb 2 bytes [0D, 76] .text ... * 2 .text C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000760d1465 2 bytes [0D, 76] .text C:\Program Files (x86)\ASUS\ASUS Live Update\LiveUpdate.exe[2924] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760d14bb 2 bytes [0D, 76] .text ... * 2 .text C:\Windows\AsScrPro.exe[1332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000760d1465 2 bytes [0D, 76] .text C:\Windows\AsScrPro.exe[1332] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760d14bb 2 bytes [0D, 76] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000760d1465 2 bytes [0D, 76] .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5980] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000760d14bb 2 bytes [0D, 76] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0025d3b2962e Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f68d4a884 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f68d4a884@90c1150915f3 0xCC 0xE7 0xD0 0x97 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0025d3b2962e (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f68d4a884 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f68d4a884@90c1150915f3 0xCC 0xE7 0xD0 0x97 ... ---- EOF - GMER 2.1 ----