GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2013-10-12 07:40:48 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD50 rev.01.0 465,76GB Running: dcf3x8m0.exe; Driver: C:\Users\KINGA\AppData\Local\Temp\kwddykob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 000000007560d03c 4 bytes [C2, 04, 00, 00] .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000077721401 2 bytes JMP 7561eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000077721419 2 bytes JMP 7562b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000077721431 2 bytes JMP 756a8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007772144a 2 bytes CALL 75601dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000777214dd 2 bytes JMP 756a7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000777214f5 2 bytes JMP 756a80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007772150d 2 bytes JMP 756a7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077721525 2 bytes JMP 756a81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007772153d 2 bytes JMP 7561f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000077721555 2 bytes JMP 7562b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007772156d 2 bytes JMP 756a86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000077721585 2 bytes JMP 756a8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007772159d 2 bytes JMP 756a7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000777215b5 2 bytes JMP 7561f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000777215cd 2 bytes JMP 7562b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000777216b2 2 bytes JMP 756a8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files\ESET\ESET NOD32 Antivirus\x86\ekrn.exe[2324] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000777216bd 2 bytes JMP 756a7d4d C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17 0000000077721401 2 bytes JMP 7561eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17 0000000077721419 2 bytes JMP 7562b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17 0000000077721431 2 bytes JMP 756a8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42 000000007772144a 2 bytes CALL 75601dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17 00000000777214dd 2 bytes JMP 756a7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17 00000000777214f5 2 bytes JMP 756a80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17 000000007772150d 2 bytes JMP 756a7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17 0000000077721525 2 bytes JMP 756a81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17 000000007772153d 2 bytes JMP 7561f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17 0000000077721555 2 bytes JMP 7562b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17 000000007772156d 2 bytes JMP 756a86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17 0000000077721585 2 bytes JMP 756a8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17 000000007772159d 2 bytes JMP 756a7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17 00000000777215b5 2 bytes JMP 7561f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17 00000000777215cd 2 bytes JMP 7562b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20 00000000777216b2 2 bytes JMP 756a8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE[2500] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31 00000000777216bd 2 bytes JMP 756a7d4d C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rpcnet.exe[2548] C:\Windows\SysWOW64\WSOCK32.dll!recv + 82 0000000070b717fa 2 bytes CALL 75601199 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rpcnet.exe[2548] C:\Windows\SysWOW64\WSOCK32.dll!recvfrom + 88 0000000070b71860 2 bytes CALL 75601199 C:\Windows\syswow64\kernel32.dll .text C:\Windows\SysWOW64\rpcnet.exe[2548] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 98 0000000070b71942 2 bytes JMP 7642c29f C:\Windows\syswow64\WS2_32.dll .text C:\Windows\SysWOW64\rpcnet.exe[2548] C:\Windows\SysWOW64\WSOCK32.dll!setsockopt + 109 0000000070b7194d 2 bytes JMP 7642418d C:\Windows\syswow64\WS2_32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077721401 2 bytes JMP 7561eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077721419 2 bytes JMP 7562b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077721431 2 bytes JMP 756a8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007772144a 2 bytes CALL 75601dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000777214dd 2 bytes JMP 756a7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000777214f5 2 bytes JMP 756a80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007772150d 2 bytes JMP 756a7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077721525 2 bytes JMP 756a81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007772153d 2 bytes JMP 7561f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077721555 2 bytes JMP 7562b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007772156d 2 bytes JMP 756a86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077721585 2 bytes JMP 756a8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007772159d 2 bytes JMP 756a7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000777215b5 2 bytes JMP 7561f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000777215cd 2 bytes JMP 7562b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000777216b2 2 bytes JMP 756a8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\AskPartnerNetwork\Toolbar\Updater\TBNotifier.exe[3884] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000777216bd 2 bytes JMP 756a7d4d C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17 0000000077721401 2 bytes JMP 7561eb26 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17 0000000077721419 2 bytes JMP 7562b513 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17 0000000077721431 2 bytes JMP 756a8609 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42 000000007772144a 2 bytes CALL 75601dfa C:\Windows\syswow64\kernel32.dll .text ... * 9 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17 00000000777214dd 2 bytes JMP 756a7efe C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17 00000000777214f5 2 bytes JMP 756a80d8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17 000000007772150d 2 bytes JMP 756a7df4 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17 0000000077721525 2 bytes JMP 756a81c2 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17 000000007772153d 2 bytes JMP 7561f088 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17 0000000077721555 2 bytes JMP 7562b885 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17 000000007772156d 2 bytes JMP 756a86c1 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17 0000000077721585 2 bytes JMP 756a8222 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17 000000007772159d 2 bytes JMP 756a7db8 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17 00000000777215b5 2 bytes JMP 7561f121 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17 00000000777215cd 2 bytes JMP 7562b29f C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20 00000000777216b2 2 bytes JMP 756a8584 C:\Windows\syswow64\kernel32.dll .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[4444] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31 00000000777216bd 2 bytes JMP 756a7d4d C:\Windows\syswow64\kernel32.dll ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\spoolsv.exe [1552:2000] 000007fef93610c8 Thread C:\Windows\System32\spoolsv.exe [1552:1932] 000007fef9326144 Thread C:\Windows\System32\spoolsv.exe [1552:1940] 000007fef9115fd0 Thread C:\Windows\System32\spoolsv.exe [1552:1876] 000007fef9103438 Thread C:\Windows\System32\spoolsv.exe [1552:1976] 000007fef91163ec Thread C:\Windows\System32\spoolsv.exe [1552:2056] 000007fef9455e5c Thread C:\Windows\system32\taskhost.exe [1808:1972] 000007fefbfc2740 Thread C:\Windows\system32\taskhost.exe [1808:1980] 000007fef9661f38 Thread C:\Windows\system32\taskhost.exe [1808:2060] 000007fefc9d1010 Thread [1884:1988] 0000000077796689 Thread [1884:1992] 0000000076c07587 Thread [1884:1048] 00000000777941fa Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:3784] 000007fef57a5c54 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:3812] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:3452] 000007feff4a3570 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:3624] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4152] 000007feff4a3570 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4488] 000007fefbc32a74 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4524] 000007fef58ff3ec Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4164] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:696] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4160] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:4744] 000007fef57a06a0 Thread C:\Program Files (x86)\ASUS\ASUS WebStorage\SERVICE\AsusWSService.exe [3660:2616] 000007fef58ca180 Thread C:\Windows\system32\svchost.exe [4324:908] 000007feeee05f00 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\e0b9a52f1e67 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\e0b9a52f1e67 (not active ControlSet) ---- EOF - GMER 2.1 ----