GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-03-05 21:28:17 Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-5 TOSHIBA_MK1652GSX rev.LV011C Running: dsj0rwov.exe; Driver: C:\Users\hp\AppData\Local\Temp\pxldipoc.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ataport.SYS!AtaPortGetScatterGatherList + A48 8E2AD9F4 1 Byte [CC] {INT 3 } ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Mozilla Firefox\plugin-container.exe[716] USER32.dll!GetWindowInfo 76BD0560 5 Bytes JMP 66E90924 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[716] USER32.dll!TrackPopupMenu 76BE1417 5 Bytes JMP 66E90ECF C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\firefox.exe[3844] ntdll.dll!LdrLoadDll 76FE79B3 5 Bytes JMP 66D15B60 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73E18864] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73E59855] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73E1B984] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73E0FB47] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73E17A29] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73E0EA65] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73E4B12D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73E1BC4A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73E10756] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73E106BD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73E071B3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [73E9D9E0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [73E37329] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73E0E109] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73E0697E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73E069A9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73E12475] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) ---- Threads - GMER 1.0.15 ---- Thread SYSTEM [4:324] 8CFE639F Thread SYSTEM [4:568] 943AC0F4 ---- Processes - GMER 1.0.15 ---- Process (*** hidden *** ) -2126509728 Process (*** hidden *** ) -2126486624 Process (*** hidden *** ) -2126481504 Process (*** hidden *** ) -2126436848 Process (*** hidden *** ) -2126293168 Process (*** hidden *** ) -2126267616 Process (*** hidden *** ) -2126097504 Process (*** hidden *** ) -2125874672 Process (*** hidden *** ) -2125821936 Process (*** hidden *** ) -2125775360 Process (*** hidden *** ) -2125666352 Process (*** hidden *** ) -2125459968 Process (*** hidden *** ) -2125344584 Process (*** hidden *** ) -2125131592 Process (*** hidden *** ) -2125130376 Process (*** hidden *** ) -2124946296 Process (*** hidden *** ) -2124783432 Process (*** hidden *** ) -2124627784 Process (*** hidden *** ) -2124580936 Process (*** hidden *** ) -2124507744 Process (*** hidden *** ) -2124506072 Process (*** hidden *** ) -2078096352 Process (*** hidden *** ) -2078036816 Process (*** hidden *** ) -2077934080 Process (*** hidden *** ) -2077835080 Process (*** hidden *** ) -2077816040 Process (*** hidden *** ) -2077798960 Process (*** hidden *** ) -2077679432 Process (*** hidden *** ) -2077556552 Process (*** hidden *** ) -2077278024 Process (*** hidden *** ) -2077235496 Process (*** hidden *** ) -2077200896 Process (*** hidden *** ) -2077132824 Process (*** hidden *** ) -2077023280 Process (*** hidden *** ) -2076942152 Process (*** hidden *** ) -2076830616 Process (*** hidden *** ) -2076816464 Process (*** hidden *** ) -2076659224 Process (*** hidden *** ) -2076435880 Process (*** hidden *** ) -2076186872 Process (*** hidden *** ) -2023647624 Process (*** hidden *** ) -2022896424 Process (*** hidden *** ) -2022851072 Process (*** hidden *** ) -2022612288 Process (*** hidden *** ) -2022407424 Process (*** hidden *** ) -2022212096 Process (*** hidden *** ) -2022048256 Process (*** hidden *** ) -2021845408 Process (*** hidden *** ) -2021732864 Process (*** hidden *** ) -2021656992 Process (*** hidden *** ) -2001660840 Process (*** hidden *** ) -1964240728 Process (*** hidden *** ) -1964238672 Process (*** hidden *** ) -1964237312 Process (*** hidden *** ) -1964234576 Process (*** hidden *** ) -1963897728 Process (*** hidden *** ) -1958801920 Process (*** hidden *** ) -1958543872 Process (*** hidden *** ) -1957941064 Process (*** hidden *** ) -1957735344 Process (*** hidden *** ) -1957699400 Process (*** hidden *** ) -1957689192 Process (*** hidden *** ) -1956744880 Process (*** hidden *** ) -1956668792 Process (*** hidden *** ) -1952440136 Process (*** hidden *** ) -1952171256 Process (*** hidden *** ) -1950863176 Process (*** hidden *** ) -1950619808 Process (*** hidden *** ) -1950619112 Process (*** hidden *** ) -1950508384 Process (*** hidden *** ) -1938096976 Process (*** hidden *** ) -1808285512 Process (*** hidden *** ) -1808137472 Process (*** hidden *** ) -1800184936 Process (*** hidden *** ) -1800021544 Process (*** hidden *** ) -1800003416 Process (*** hidden *** ) -1799731672 Process (*** hidden *** ) -1799730976 Process (*** hidden *** ) -1752996448 Process (*** hidden *** ) -1751998976 Process (*** hidden *** ) -1751723848 Process (*** hidden *** ) -1751381176 Process (*** hidden *** ) -1751151784 Process (*** hidden *** ) -1644300136 Process (*** hidden *** ) -1480295224 Process (*** hidden *** ) -1480134472 Process (*** hidden *** ) -1454669640 Process (*** hidden *** ) -1454346896 Process (*** hidden *** ) -1286996648 Process (*** hidden *** ) -1284901032 Process (*** hidden *** ) -1284509512 Process (*** hidden *** ) -1282148304 Process (*** hidden *** ) -1276773368 Process (*** hidden *** ) -1276512088 Process (*** hidden *** ) -1269434080 Process (*** hidden *** ) -1267994440 Process (*** hidden *** ) -1267731168 Process (*** hidden *** ) -1265895672 Process (*** hidden *** ) -1264455496 Process (*** hidden *** ) -1263275848 Process (*** hidden *** ) -1261438832 Process (*** hidden *** ) -1259081544 Process (*** hidden *** ) -1258948720 Process (*** hidden *** ) -1258164040 Process (*** hidden *** ) -1257770160 Process (*** hidden *** ) -1250559488 Process (*** hidden *** ) -1248330576 Process (*** hidden *** ) -1248068432 Process (*** hidden *** ) -1247937416 Process (*** hidden *** ) -1247283048 Process (*** hidden *** ) -1247151712 Process (*** hidden *** ) -1247150928 Process (*** hidden *** ) -1245971280 Process (*** hidden *** ) -1244925768 Process (*** hidden *** ) -1244924992 Process (*** hidden *** ) -1244924104 Process (*** hidden *** ) -1243482944 Process (*** hidden *** ) -1243482000 Process (*** hidden *** ) -1242041392 Process (*** hidden *** ) -1239943168 Process (*** hidden *** ) -1239941800 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002186306764 Reg HKLM\SYSTEM\ControlSet098\Services\BTHPORT\Parameters\Keys\002186306764 (not active ControlSet) ---- EOF - GMER 1.0.15 ---- GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-03-05 21:28:17 Windows 6.0.6001 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-5 TOSHIBA_MK1652GSX rev.LV011C Running: dsj0rwov.exe; Driver: C:\Users\hp\AppData\Local\Temp\pxldipoc.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ataport.SYS!AtaPortGetScatterGatherList + A48 8E2AD9F4 1 Byte [CC] {INT 3 } ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\Mozilla Firefox\plugin-container.exe[716] USER32.dll!GetWindowInfo 76BD0560 5 Bytes JMP 66E90924 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\plugin-container.exe[716] USER32.dll!TrackPopupMenu 76BE1417 5 Bytes JMP 66E90ECF C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) .text C:\Program Files\Mozilla Firefox\firefox.exe[3844] ntdll.dll!LdrLoadDll 76FE79B3 5 Bytes JMP 66D15B60 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation) ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73E18864] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73E59855] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73E1B984] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73E0FB47] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73E17A29] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73E0EA65] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStreamICM] [73E4B12D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromStream] [73E1BC4A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73E10756] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73E106BD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73E071B3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFileICM] [73E9D9E0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipLoadImageFromFile] [73E37329] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73E0E109] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73E0697E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73E069A9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1740] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73E12475] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.0.6001.18551_none_9e7a1850c9c1b3dc\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Dynamiczna struktura WDF/Microsoft Corporation) ---- Threads - GMER 1.0.15 ---- Thread SYSTEM [4:324] 8CFE639F Thread SYSTEM [4:568] 943AC0F4 ---- Processes - GMER 1.0.15 ---- Process (*** hidden *** ) -2126509728 Process (*** hidden *** ) -2126486624 Process (*** hidden *** ) -2126481504 Process (*** hidden *** ) -2126436848 Process (*** hidden *** ) -2126293168 Process (*** hidden *** ) -2126267616 Process (*** hidden *** ) -2126097504 Process (*** hidden *** ) -2125874672 Process (*** hidden *** ) -2125821936 Process (*** hidden *** ) -2125775360 Process (*** hidden *** ) -2125666352 Process (*** hidden *** ) -2125459968 Process (*** hidden *** ) -2125344584 Process (*** hidden *** ) -2125131592 Process (*** hidden *** ) -2125130376 Process (*** hidden *** ) -2124946296 Process (*** hidden *** ) -2124783432 Process (*** hidden *** ) -2124627784 Process (*** hidden *** ) -2124580936 Process (*** hidden *** ) -2124507744 Process (*** hidden *** ) -2124506072 Process (*** hidden *** ) -2078096352 Process (*** hidden *** ) -2078036816 Process (*** hidden *** ) -2077934080 Process (*** hidden *** ) -2077835080 Process (*** hidden *** ) -2077816040 Process (*** hidden *** ) -2077798960 Process (*** hidden *** ) -2077679432 Process (*** hidden *** ) -2077556552 Process (*** hidden *** ) -2077278024 Process (*** hidden *** ) -2077235496 Process (*** hidden *** ) -2077200896 Process (*** hidden *** ) -2077132824 Process (*** hidden *** ) -2077023280 Process (*** hidden *** ) -2076942152 Process (*** hidden *** ) -2076830616 Process (*** hidden *** ) -2076816464 Process (*** hidden *** ) -2076659224 Process (*** hidden *** ) -2076435880 Process (*** hidden *** ) -2076186872 Process (*** hidden *** ) -2023647624 Process (*** hidden *** ) -2022896424 Process (*** hidden *** ) -2022851072 Process (*** hidden *** ) -2022612288 Process (*** hidden *** ) -2022407424 Process (*** hidden *** ) -2022212096 Process (*** hidden *** ) -2022048256 Process (*** hidden *** ) -2021845408 Process (*** hidden *** ) -2021732864 Process (*** hidden *** ) -2021656992 Process (*** hidden *** ) -2001660840 Process (*** hidden *** ) -1964240728 Process (*** hidden *** ) -1964238672 Process (*** hidden *** ) -1964237312 Process (*** hidden *** ) -1964234576 Process (*** hidden *** ) -1963897728 Process (*** hidden *** ) -1958801920 Process (*** hidden *** ) -1958543872 Process (*** hidden *** ) -1957941064 Process (*** hidden *** ) -1957735344 Process (*** hidden *** ) -1957699400 Process (*** hidden *** ) -1957689192 Process (*** hidden *** ) -1956744880 Process (*** hidden *** ) -1956668792 Process (*** hidden *** ) -1952440136 Process (*** hidden *** ) -1952171256 Process (*** hidden *** ) -1950863176 Process (*** hidden *** ) -1950619808 Process (*** hidden *** ) -1950619112 Process (*** hidden *** ) -1950508384 Process (*** hidden *** ) -1938096976 Process (*** hidden *** ) -1808285512 Process (*** hidden *** ) -1808137472 Process (*** hidden *** ) -1800184936 Process (*** hidden *** ) -1800021544 Process (*** hidden *** ) -1800003416 Process (*** hidden *** ) -1799731672 Process (*** hidden *** ) -1799730976 Process (*** hidden *** ) -1752996448 Process (*** hidden *** ) -1751998976 Process (*** hidden *** ) -1751723848 Process (*** hidden *** ) -1751381176 Process (*** hidden *** ) -1751151784 Process (*** hidden *** ) -1644300136 Process (*** hidden *** ) -1480295224 Process (*** hidden *** ) -1480134472 Process (*** hidden *** ) -1454669640 Process (*** hidden *** ) -1454346896 Process (*** hidden *** ) -1286996648 Process (*** hidden *** ) -1284901032 Process (*** hidden *** ) -1284509512 Process (*** hidden *** ) -1282148304 Process (*** hidden *** ) -1276773368 Process (*** hidden *** ) -1276512088 Process (*** hidden *** ) -1269434080 Process (*** hidden *** ) -1267994440 Process (*** hidden *** ) -1267731168 Process (*** hidden *** ) -1265895672 Process (*** hidden *** ) -1264455496 Process (*** hidden *** ) -1263275848 Process (*** hidden *** ) -1261438832 Process (*** hidden *** ) -1259081544 Process (*** hidden *** ) -1258948720 Process (*** hidden *** ) -1258164040 Process (*** hidden *** ) -1257770160 Process (*** hidden *** ) -1250559488 Process (*** hidden *** ) -1248330576 Process (*** hidden *** ) -1248068432 Process (*** hidden *** ) -1247937416 Process (*** hidden *** ) -1247283048 Process (*** hidden *** ) -1247151712 Process (*** hidden *** ) -1247150928 Process (*** hidden *** ) -1245971280 Process (*** hidden *** ) -1244925768 Process (*** hidden *** ) -1244924992 Process (*** hidden *** ) -1244924104 Process (*** hidden *** ) -1243482944 Process (*** hidden *** ) -1243482000 Process (*** hidden *** ) -1242041392 Process (*** hidden *** ) -1239943168 Process (*** hidden *** ) -1239941800 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\002186306764 Reg HKLM\SYSTEM\ControlSet098\Services\BTHPORT\Parameters\Keys\002186306764 (not active ControlSet) ---- EOF - GMER 1.0.15 ----