GMER 2.1.19163 - http://www.gmer.net Rootkit scan 2014-01-05 10:39:10 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP4T0L0-8 SAMSUNG_HD103SJ rev.1AJ10001 931,51GB Running: 1jg0npqw.exe; Driver: C:\Users\cwirek\AppData\Local\Temp\ufldqpob.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\uTorrent\uTorrent.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76] .text C:\Program Files (x86)\uTorrent\uTorrent.exe[2204] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76] .text ... * 2 .text C:\Windows\SysWOW64\{$3496-8737-3294-4624-4253$}\appsvc.exe[2396] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76] .text C:\Windows\SysWOW64\{$3496-8737-3294-4624-4253$}\appsvc.exe[2396] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76] .text ... * 2 .text C:\Program Files (x86)\totalcmd\TOTALCMD.EXE[2808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000076ed1465 2 bytes [ED, 76] .text C:\Program Files (x86)\totalcmd\TOTALCMD.EXE[2808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 0000000076ed14bb 2 bytes [ED, 76] .text ... * 2 ---- Kernel IAT/EAT - GMER 2.1 ---- IAT C:\Windows\System32\win32k.sys[ntoskrnl.exe!KeUserModeCallback] [fffff880045aaea4] \SystemRoot\system32\DRIVERS\klif.sys [PAGE] ---- Threads - GMER 2.1 ---- Thread C:\Windows\System32\svchost.exe [1740:3936] 000007fef0d59688 ---- Registry - GMER 2.1 ---- Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\Users\cwirek\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ROOT\xb4óÊ\xa6\Ð\xb6ÔØ ROOT\xb4óÊ\xa6.lnk 1 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\StartPage\NewShortcuts@C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ROOT\xb4óÊ\xa6\Ð\xb6ÔØ ROOT\xb4óÊ\xa6.lnk 1 ---- EOF - GMER 2.1 ----