GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-11-07 21:41:50
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9500325AS rev.D005DEM1 465,76GB
Running: 5dp5oq2y.exe; Driver: C:\Users\Rostov\AppData\Local\Temp\kfrdypob.sys


---- User code sections - GMER 2.1 ----

.text   C:\Program Files (x86)\Hot Keyboard Pro\HotKeyb.exe[2880] C:\windows\syswow64\psapi.dll!GetModuleInformation + 69   00000000757c1465 2 bytes [7C, 75]
.text   C:\Program Files (x86)\Hot Keyboard Pro\HotKeyb.exe[2880] C:\windows\syswow64\psapi.dll!GetModuleInformation + 155  00000000757c14bb 2 bytes [7C, 75]
.text   ...                                                                                                                 * 2
.text   C:\Program Files (x86)\PopTrayU\PopTrayU.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69          00000000757c1465 2 bytes [7C, 75]
.text   C:\Program Files (x86)\PopTrayU\PopTrayU.exe[2544] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155         00000000757c14bb 2 bytes [7C, 75]
.text   ...                                                                                                                 * 2
.text   C:\Program Files (x86)\Gadu-Gadu 10\gg.exe[2872] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            00000000757c1465 2 bytes [7C, 75]
.text   C:\Program Files (x86)\Gadu-Gadu 10\gg.exe[2872] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           00000000757c14bb 2 bytes [7C, 75]
.text   ...                                                                                                                 * 2

---- Kernel IAT/EAT - GMER 2.1 ----

IAT     C:\windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback]                                                     [fffff880046d7ea4] \SystemRoot\system32\DRIVERS\klif.sys [PAGE]

---- Threads - GMER 2.1 ----

Thread  C:\windows\SysWOW64\ntdll.dll [3740:3744]                                                                           00000000012e301f
Thread  C:\windows\SysWOW64\ntdll.dll [3740:3748]                                                                           0000000072767240
Thread  C:\windows\SysWOW64\ntdll.dll [3740:3752]                                                                           00000000727675f0
Thread  C:\windows\SysWOW64\ntdll.dll [3740:3756]                                                                           00000000727675f0

---- Registry - GMER 2.1 ----

Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0015007f6c3b                                         
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\6427370fcc96                                         
Reg     HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\c0cb38d054a8                                         
Reg     HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch@Epoch                                                     9801
Reg     HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch                                                    6808
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\0015007f6c3b (not active ControlSet)                     
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\6427370fcc96 (not active ControlSet)                     
Reg     HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\c0cb38d054a8 (not active ControlSet)                     

---- EOF - GMER 2.1 ----