GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-03-02 20:05:20
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 HITACHI_ rev.PC4Z 465,76GB
Running: 8gnj7gjo.exe; Driver: C:\Users\Kuba\AppData\Local\Temp\afrcaaoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Greenshot\Greenshot.exe[3356] C:\windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                 0000000077c9fa40 5 bytes JMP 0000000100381d32
.text  C:\Program Files (x86)\Greenshot\Greenshot.exe[3356] C:\windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                0000000077c9fd98 5 bytes JMP 0000000100381c0e
.text  C:\Program Files (x86)\Greenshot\Greenshot.exe[3356] C:\windows\SysWOW64\ntdll.dll!NtResumeThread                                                      0000000077ca0068 5 bytes JMP 0000000100381b2f
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3696] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000758e1465 2 bytes [8E, 75]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE[3696] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000758e14bb 2 bytes [8E, 75]
.text  ...                                                                                                                                                    * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3724] C:\windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                  0000000077c9fa40 5 bytes JMP 00000001004e1d32
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3724] C:\windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                 0000000077c9fd98 5 bytes JMP 00000001004e1c0e
.text  C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe[3724] C:\windows\SysWOW64\ntdll.dll!NtResumeThread                       0000000077ca0068 5 bytes JMP 00000001004e1b2f
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3820] C:\windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                               0000000077c9fa40 5 bytes JMP 00000001003f1d32
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3820] C:\windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                              0000000077c9fd98 5 bytes JMP 00000001003f1c0e
.text  C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[3820] C:\windows\SysWOW64\ntdll.dll!NtResumeThread                                    0000000077ca0068 5 bytes JMP 00000001003f1b2f
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[3872] C:\windows\SysWOW64\ntdll.dll!NtEnumerateValueKey                                                 0000000077c9fa40 5 bytes JMP 0000000100a31d32
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[3872] C:\windows\SysWOW64\ntdll.dll!NtQueryDirectoryFile                                                0000000077c9fd98 5 bytes JMP 0000000100a31c0e
.text  C:\Program Files (x86)\iTunes\iTunesHelper.exe[3872] C:\windows\SysWOW64\ntdll.dll!NtResumeThread                                                      0000000077ca0068 5 bytes JMP 0000000100a31b2f
.text  c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[920] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                      00000000758e1465 2 bytes [8E, 75]
.text  c:\PROGRA~2\mcafee\SITEAD~1\saui.exe[920] C:\windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                     00000000758e14bb 2 bytes [8E, 75]
.text  ...                                                                                                                                                    * 2

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{D6971925-1BAF-461D-8991-68ECA5140DAC}\Connection@Name            isatap.{CB5D6BA0-94D2-4A97-8CF9-B104A9ECE634}
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind               \Device\{74512344-6719-4B73-9595-38CC5E496646}?\Device\{1B46C195-FC7E-475A-A82F-55B8A5A4002D}?\Device\{096226A2-533A-4BCF-8FB3-60F92E2A2CE2}?\Device\{D6971925-1BAF-461D-8991-68ECA5140DAC}?\Device\{A11930D2-078E-4EA7-868A-C162BA490C2B}?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route              "{74512344-6719-4B73-9595-38CC5E496646}"?"{1B46C195-FC7E-475A-A82F-55B8A5A4002D}"?"{096226A2-533A-4BCF-8FB3-60F92E2A2CE2}"?"{D6971925-1BAF-461D-8991-68ECA5140DAC}"?"{A11930D2-078E-4EA7-868A-C162BA490C2B}"?
Reg    HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export             \Device\TCPIP6TUNNEL_{74512344-6719-4B73-9595-38CC5E496646}?\Device\TCPIP6TUNNEL_{1B46C195-FC7E-475A-A82F-55B8A5A4002D}?\Device\TCPIP6TUNNEL_{096226A2-533A-4BCF-8FB3-60F92E2A2CE2}?\Device\TCPIP6TUNNEL_{D6971925-1BAF-461D-8991-68ECA5140DAC}?\Device\TCPIP6TUNNEL_{A11930D2-078E-4EA7-868A-C162BA490C2B}?
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002269ec2d88                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\18f46af4d8fb                                                                            
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D6971925-1BAF-461D-8991-68ECA5140DAC}@InterfaceName                                 isatap.{CB5D6BA0-94D2-4A97-8CF9-B104A9ECE634}
Reg    HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{D6971925-1BAF-461D-8991-68ECA5140DAC}@ReusableType                                  0
Reg    HKLM\SYSTEM\CurrentControlSet\services\SharedAccess\Epoch2@Epoch                                                                                       15082
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002269ec2d88 (not active ControlSet)                                                        
Reg    HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\18f46af4d8fb (not active ControlSet)                                                        

---- EOF - GMER 2.1 ----