GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2016-02-21 19:22:40 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 TOSHIBA_MK3252GSX rev.LV010M 298,09GB Running: yn46l54z.exe; Driver: C:\Users\Dom\AppData\Local\Temp\ufldqpow.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\Windows\System32\win32k.sys!W32pServiceTable fffff96000145600 7 bytes [00, 66, F3, FF, 01, 70, F0] .text C:\Windows\System32\win32k.sys!W32pServiceTable + 8 fffff96000145608 3 bytes [C0, 06, 02] ---- Processes - GMER 2.1 ---- Library C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{4AF47459-8EBD-4111-84DB-F467CA71E9AB}\offreg.2308.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2308](2016-02-21 17:11:43) 000007fef74d0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002258e2938d Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002258e2938d (not active ControlSet) ---- Files - GMER 2.1 ---- File C:\Users\Dom\AppData\Local\Opera Software\Opera Stable\Cache\f_000019 53026 bytes ---- EOF - GMER 2.1 ----