GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-09-13 14:35:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 HITACHI_ rev.PC4Z 465,76GB
Running: m57g1hli.exe; Driver: C:\Users\Kuba\AppData\Local\Temp\afrcaaoc.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                                     fffff800037a9000 45 bytes [83, 70, 08, 01, 4C, 89, 6C, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607                                                                                     fffff800037a902f 34 bytes JMP fffff801037a8cc9

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2716] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000761b1465 2 bytes [1B, 76]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[2716] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000761b14bb 2 bytes [1B, 76]
.text     ...                                                                                                                                                    * 2

---- Threads - GMER 2.1 ----

Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2556:3692]                                                                                 0000000075c77587
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2556:3684]                                                                                 000000006cc60cb3
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2556:3744]                                                                                 0000000077e52e25
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2556:3128]                                                                                 0000000077e53e45
Thread    C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2556:892]                                                                                  0000000077e53e45

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                                                                            
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46af4d8fb                                                                            
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)                                                        
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46af4d8fb (not active ControlSet)                                                        

---- EOF - GMER 2.1 ----