GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-01-05 14:31:58
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\00000099 HGST rev.GH2O 465,76GB
Running: ekugmx5z.exe; Driver: C:\Users\KSIEGOWA\AppData\Local\Temp\uwdirpow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 674                               fffff80003206092 4 bytes [00, 00, 00, 00]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 681                               fffff80003206099 9 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\SysWOW64\RunDll32.exe[5368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000753a1465 2 bytes [3A, 75]
.text     C:\Windows\SysWOW64\RunDll32.exe[5368] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000753a14bb 2 bytes [3A, 75]
.text     ...                                                                                              * 2

---- Threads - GMER 2.1 ----

Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2396]          0000000077173e85
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2096]          0000000077172e65
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2440]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2428]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2816]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2520]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2956]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2968]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2212]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2228]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:2232]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:1096]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3496]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3500]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3504]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:4036]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:4040]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:4052]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:4060]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3464]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:520]           000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:556]           0000000077173e85
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:1464]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3784]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:1892]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3772]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:3944]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:6008]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:6012]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:6016]          000000006bfc29e1
Thread    C:\Program Files (x86)\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2124:6020]          000000006bfc29e1

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18cf5eb0431f                      
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18cf5eb0431f (not active ControlSet)  

---- EOF - GMER 2.1 ----