GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-17 09:20:35 Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 ST950032 rev.D005 465,76GB Running: oiv1d25w.exe; Driver: C:\Users\JKRASN~1\AppData\Local\Temp\kftdipow.sys ---- User code sections - GMER 2.1 ---- .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[1116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75] .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe[1116] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75] .text ... * 2 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3240] C:\Windows\syswow64\kernel32.dll!SetFileCompletionNotificationModes 0000000075c7b116 5 bytes JMP 0000000103b48e70 .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 00000000759e1465 2 bytes [9E, 75] .text C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe[3240] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000759e14bb 2 bytes [9E, 75] .text ... * 2 ? C:\Windows\system32\mssprxy.dll [3240] entry point in ".rdata" section 00000000731e71e6 .text C:\Program Files\AVAST Software\Avast\avastui.exe[4908] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075c0d03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Program Files\AVAST Software\Avast\avastui.exe[4908] C:\Windows\syswow64\kernel32.dll!SetFileCompletionNotificationModes 0000000075c7b116 5 bytes JMP 0000000103d78e70 .text C:\Program Files\AVAST Software\Avast\avastui.exe[4696] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075c0d03c 8 bytes [31, C0, C2, 04, 00, 90, 90, ...] .text C:\Users\Jkrasnodebski\Desktop\oiv1d25w.exe[4348] C:\Windows\syswow64\kernel32.dll!SetFileCompletionNotificationModes 0000000075c7b116 5 bytes JMP 00000001048b8e70 ---- Threads - GMER 2.1 ---- Thread [1228:1272] 00000000777dc662 Thread [1228:1300] 00000000777f269d Thread [1228:1304] 0000000074c5f28e Thread [1228:1316] 00000000759c7587 Thread [1228:1400] 000000007395c120 Thread [1228:1652] 000000007415b330 Thread [1228:1656] 000000007415a5a0 Thread [1228:1684] 0000000074c5f28e Thread [1228:1692] 000000007588c89d Thread [1228:2304] 00000000741459d0 Thread [1228:2416] 00000000741459d0 Thread [1228:2420] 00000000741459d0 Thread [1228:2424] 00000000741459d0 Thread [1228:2496] 00000000741459d0 Thread [1228:2500] 0000000074146a20 Thread [1228:2504] 0000000074146a20 Thread [1228:2508] 0000000074145f80 Thread [1228:2512] 00000000741a4ed0 Thread [1228:2516] 00000000741a3cc0 Thread [1228:2520] 00000000741a4140 Thread [1228:2524] 0000000074148eb0 Thread [1228:2528] 0000000074148eb0 Thread [1228:2532] 0000000074148eb0 Thread [1228:2536] 0000000074148eb0 Thread [1228:2540] 0000000074148eb0 Thread [1228:2544] 0000000074148ba0 Thread [1228:2548] 00000000702714b0 Thread [1228:2552] 00000000702754c0 Thread [1228:2556] 00000000702754c0 Thread [1228:2564] 000000007415c340 Thread [1228:2568] 0000000074148290 Thread [1228:3256] 000000000754c1f0 Thread [1228:3264] 000000000754c1f0 Thread [1228:3272] 000000000754c1f0 Thread [1228:3088] 000000000754c1f0 Thread [1228:3500] 0000000074c5f28e Thread [1228:4080] 0000000073f37840 Thread [1228:3620] 0000000074c5f28e Thread [1228:3660] 00000000742ef5a0 Thread [1228:3076] 00000000742f2560 Thread [1228:816] 0000000074c5f28e Thread [1228:3700] 0000000074c5f28e Thread [1228:3716] 0000000074c5f28e Thread [1228:3728] 0000000074c5f28e Thread [1228:3720] 0000000074c5f28e Thread [1228:3696] 0000000074c5f28e Thread [1228:852] 0000000074c5f28e Thread [1228:3744] 000000006e7b83a0 Thread [1228:1860] 000000006e7b83a0 Thread [1228:3724] 000000006e7b83a0 Thread [1228:1884] 000000006e7b83a0 Thread [1228:3704] 000000006e7b83a0 Thread [1228:1576] 000000006e7b83a0 Thread [1228:3916] 0000000074c5f28e Thread [1228:4004] 0000000074c5f28e Thread [1228:3540] 0000000070566f14 Thread [1228:6040] 00000000777f269d Thread [1228:2824] 00000000777f269d Thread [1228:2676] 00000000777f269d Thread [1228:2916] 00000000777f269d Thread [1228:1920] 00000000777f269d ---- Registry - GMER 2.1 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc7737688e35 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc7737688e35 (not active ControlSet) ---- EOF - GMER 2.1 ----