GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-09-03 15:49:31 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 HITACHI_ rev.PC4Z 465,76GB Running: gmer.exe; Driver: C:\Users\Kuba\AppData\Local\Temp\afrcaaoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2932] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000769a1465 2 bytes [9A, 76] .text C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2932] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000769a14bb 2 bytes [9A, 76] .text ... * 2 .text C:\Users\Kuba\Downloads\OTL.com[1764] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 69 00000000769a1465 2 bytes [9A, 76] .text C:\Users\Kuba\Downloads\OTL.com[1764] C:\windows\syswow64\PSAPI.dll!GetModuleInformation + 155 00000000769a14bb 2 bytes [9A, 76] .text ... * 2 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46af4d8fb Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46af4d8fb (not active ControlSet) ---- EOF - GMER 2.1 ----