GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-11-10 20:48:00
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE3O 465,76GB
Running: 5nzhjmtw.exe; Driver: C:\Users\Ewelina\AppData\Local\Temp\agadyuob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                     fffff80002206000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                                                                                     fffff8000220602f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe[1984] C:\windows\SysWOW64\ntdll.dll!NtQueryValueKey                                    0000000077cdfaa8 5 bytes JMP 00000001738d19b0
.text     C:\Program Files (x86)\Kaspersky Lab\Kaspersky PURE 3.0\avp.exe[1984] C:\windows\SysWOW64\ntdll.dll!NtProtectVirtualMemory                             0000000077ce0038 5 bytes JMP 00000001738d2066
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2112] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076d91465 2 bytes [D9, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe[2112] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076d914bb 2 bytes [D9, 76]
.text     ...                                                                                                                                                    * 2
?         C:\windows\system32\mssprxy.dll [2940] entry point in ".rdata" section                                                                                 00000000729a71e6
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3932] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000076d91465 2 bytes [D9, 76]
.text     C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3932] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000076d914bb 2 bytes [D9, 76]
.text     ...                                                                                                                                                    * 2

---- Kernel IAT/EAT - GMER 2.1 ----

IAT       C:\windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback]                                                                                        [fffff88003686ea4] \SystemRoot\system32\DRIVERS\klif.sys [PAGE]

---- Threads - GMER 2.1 ----

Thread    C:\windows\System32\svchost.exe [2832:4448]                                                                                                            000007fef8729688
Thread    C:\windows\SysWOW64\ntdll.dll [2876:2936]                                                                                                              000000000113301f

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\50b7c3134cc6                                                                            
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\50b7c3134cc6@101dc01d5184                                                               0x83 0x79 0x9C 0x97 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\50b7c3134cc6 (not active ControlSet)                                                        
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\50b7c3134cc6@101dc01d5184                                                                   0x83 0x79 0x9C 0x97 ...

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                                  unknown MBR code

---- EOF - GMER 2.1 ----