GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-03-31 22:08:37 Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HDS721616PLA380 rev.P22OA70A 153,39GB Running: 8wb3isbw.exe; Driver: C:\Users\Mad_Egg\AppData\Local\Temp\uwldypob.sys ---- Kernel code sections - GMER 2.1 ---- .text ntkrnlpa.exe!ZwRequestWaitReplyPort + 1495 862879E5 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 862C1312 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} ---- Devices - GMER 2.1 ---- AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys ---- Registry - GMER 2.1 ---- Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{5CEDBD11-A3D3-11E4-8672-806E6F6E6963} 1249098704 Reg HKLM\SOFTWARE\Microsoft\Windows Search\UsnNotifier\Windows\Catalogs\SystemIndex@{5CEDBD12-A3D3-11E4-8672-806E6F6E6963} 23463056 ---- Files - GMER 2.1 ---- File C:\ProgramData\Microsoft\Windows Defender\Definition Updates\{E04B64EA-23C2-4CD9-BC1B-E4D37E91D79E}\offreg.dll (size mismatch) 62576/0 bytes executable ---- EOF - GMER 2.1 ----