GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-08-21 22:43:33
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950042 rev.0001 465,76GB
Running: gmer.exe; Driver: C:\Users\Turek\AppData\Local\Temp\ugtyrpow.sys


---- User code sections - GMER 2.1 ----

.text    C:\Users\Turek\Downloads\OTH.exe[1580] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69                                                                                                     0000000075741465 2 bytes [74, 75]
.text    C:\Users\Turek\Downloads\OTH.exe[1580] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155                                                                                                    00000000757414bb 2 bytes [74, 75]
.text    ...                                                                                                                                                                                                * 2
.text    C:\Users\Turek\Downloads\otl.exe[2332] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 69                                                                                                     0000000075741465 2 bytes [74, 75]
.text    C:\Users\Turek\Downloads\otl.exe[2332] C:\Windows\syswow64\PSAPI.dll!GetModuleInformation + 155                                                                                                    00000000757414bb 2 bytes [74, 75]
.text    ...                                                                                                                                                                                                * 2
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                0000000075741465 2 bytes [74, 75]
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[2760] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                               00000000757414bb 2 bytes [74, 75]
.text    ...                                                                                                                                                                                                * 2
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                                0000000075741465 2 bytes [74, 75]
.text    C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE[3388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                               00000000757414bb 2 bytes [74, 75]
.text    ...                                                                                                                                                                                                * 2
---- Processes - GMER 2.1 ----

Library  C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{25562B3B-29DF-41AD-B5BD-2CE67735240E}\offreg.dll (*** suspicious ***) @ C:\Windows\System32\svchost.exe [2000](2014-08-20 07:25:58)  000007fef83b0000
Process  C:\Users\Turek\AppData\Local\Temp\Rar$EXa0.063\gmer.exe (*** suspicious ***) @ C:\Users\Turek\AppData\Local\Temp\Rar$EXa0.063\gmer.exe [3600](2014-08-21 19:48:59)                                 0000000000400000

---- Registry - GMER 2.1 ----

Reg      HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\0c6076d49816 (not active ControlSet)                                                                                                    
Reg      HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\f07bcbd651cb (not active ControlSet)                                                                                                    
Reg      HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\f07bcbd651cb@1886ac6c3609                                                                                                               0xBA 0xB2 0x94 0xEB ...
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\0c6076d49816                                                                                                                        
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\f07bcbd651cb                                                                                                                        
Reg      HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\f07bcbd651cb@1886ac6c3609                                                                                                           0xBA 0xB2 0x94 0xEB ...
Reg      HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\0c6076d49816 (not active ControlSet)                                                                                                    
Reg      HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\f07bcbd651cb (not active ControlSet)                                                                                                    
Reg      HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\f07bcbd651cb@1886ac6c3609                                                                                                               0xBA 0xB2 0x94 0xEB ...

---- Files - GMER 2.1 ----

File     C:\Users\Turek\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\BVXKT1TD\61-diagnostyka-ogolne-raporty-systemowe[1].htm                                                        0 bytes
File     C:\Users\Turek\AppData\Local\Temp\~DF216A34635FB7002F.TMP                                                                                                                                          16384 bytes

---- EOF - GMER 2.1 ----