GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-10-13 20:21:09
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE3O 465,76GB
Running: dre1797x.exe; Driver: C:\Users\Browar\AppData\Local\Temp\ufdiipob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                               fffff800047f8000 45 bytes [00, 00, 10, 02, 4D, 6D, 43, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 575                               fffff800047f802f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                 000007fefd442db0 5 bytes JMP 000007fffd430180
.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW            000007fefd4437d0 7 bytes JMP 000007fffd4300d8
.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW              000007fefd448ef0 6 bytes JMP 000007fffd430148
.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW          000007fefd45af60 5 bytes JMP 000007fffd430110
.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo           000007feff2f89f0 8 bytes JMP 000007fffd4301f0
.text     C:\Windows\system32\Dwm.exe[1976] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList         000007feff2fbe50 8 bytes JMP 000007fffd4301b8
.text     C:\Windows\AsScrPro.exe[2396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000076ae1465 2 bytes [AE, 76]
.text     C:\Windows\AsScrPro.exe[2396] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           0000000076ae14bb 2 bytes [AE, 76]
.text     ...                                                                                              * 2

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\742f68f74218                      
Reg       HKLM\SYSTEM\CurrentControlSet\services\cmdAgent\Mode\Configurations@SymbolicLinkValue            0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\cmdAgent\Mode\Data@SymbolicLinkValue                      0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\cmdAgent\Mode\Options@SymbolicLinkValue                   0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\742f68f74218 (not active ControlSet)  
Reg       HKLM\SYSTEM\ControlSet002\services\cmdAgent\Mode\Configurations@SymbolicLinkValue                0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\ControlSet002\services\cmdAgent\Mode\Data@SymbolicLinkValue                          0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\ControlSet002\services\cmdAgent\Mode\Options@SymbolicLinkValue                       0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\Software\COMODO\Cam@SymbolicLinkValue                                                0x5C 0x00 0x52 0x00 ...
Reg       HKLM\SYSTEM\Software\COMODO\Firewall Pro@SymbolicLinkValue                                       0x5C 0x00 0x52 0x00 ...

---- EOF - GMER 2.1 ----