GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2014-04-14 21:30:54 Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 596,17GB Running: 4rxjh9b2.exe; Driver: C:\Users\rf\AppData\Local\Temp\ugtcykoc.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69 00000000752c1465 2 bytes [2C, 75] .text C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[1684] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155 00000000752c14bb 2 bytes [2C, 75] .text ... * 2 .text C:\Users\rf\AppData\Local\FluxSoftware\Flux\flux.exe[3840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000752c1465 2 bytes [2C, 75] .text C:\Users\rf\AppData\Local\FluxSoftware\Flux\flux.exe[3840] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000752c14bb 2 bytes [2C, 75] .text ... * 2 .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000752c1465 2 bytes [2C, 75] .text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[3816] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000752c14bb 2 bytes [2C, 75] .text ... * 2 .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000752c1465 2 bytes [2C, 75] .text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2528] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000752c14bb 2 bytes [2C, 75] .text ... * 2 ---- Processes - GMER 2.1 ---- Library C:\Users\rf\AppData\Local\Microsoft\Windows Sidebar\Gadgets\MonitorSystemu.Gadget\binaries\MonitorSystemu.Utils.dll (*** suspicious ***) @ C:\Program Files\Windows Sidebar\sidebar.exe [2368](2011-03-18 15:59:26) 000000006b5c0000 ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde691ec9 Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde691ec9@002108deb04e 0x8A 0x49 0x5D 0x6B ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde691ec9@0016530d8109 0x25 0xAA 0x64 0xF0 ... Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\4cedde691ec9@0cdfa4752e6a 0x3C 0x36 0x99 0x3A ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x3C 0x4D 0x78 0x2A ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde691ec9 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde691ec9@002108deb04e 0x8A 0x49 0x5D 0x6B ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde691ec9@0016530d8109 0x25 0xAA 0x64 0xF0 ... Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\4cedde691ec9@0cdfa4752e6a 0x3C 0x36 0x99 0x3A ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x3C 0x4D 0x78 0x2A ... ---- Disk sectors - GMER 2.1 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.1 ----