GMER 2.2.19882 - http://www.gmer.net Rootkit scan 2016-08-30 21:19:01 Windows 6.2.9200 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-2 LITEONIT_LCS-128M6S rev.DC77101 119,24GB Running: g1ookri2.exe; Driver: C:\Users\Nuno\AppData\Local\Temp\uwldqpow.sys ---- Threads - GMER 2.2 ---- Thread C:\Windows\system32\csrss.exe [560:588] fffff960009702d0 ---- Registry - GMER 2.2 ---- Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemStartTime 0x54 0x29 0xDF 0x28 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData@SystemLastStartTime 0x09 0x6F 0xF9 0xD8 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\CMF\SqmData\BootLanguages@pl-PL 97 Reg HKLM\SYSTEM\CurrentControlSet\Control\GraphicsDrivers\Configuration\GSM5A50SerialNumber_0C_07DE_34^2659E872E18BC27E4155B2BD404CDAC8@Timestamp 0x98 0x1A 0x94 0x29 ... Reg HKLM\SYSTEM\CurrentControlSet\Control\Lsa@LsaPid 608 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Executive@UuidSequenceNumber 3900084 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Kernel\RNG@RNGAuxiliarySeed 1682861109 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BootId 106 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Memory Management\PrefetchParameters@BaseTime 482691564 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@POSTTime 11479 Reg HKLM\SYSTEM\CurrentControlSet\Control\Session Manager\Power@FwPOSTTime 11404 Reg HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server@InstanceID 12f38cd2-fe85-4a40-b0a6-dd7c94e Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\AITEventLog@FileCounter 1 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\SQMLogger@FileCounter 6 Reg HKLM\SYSTEM\CurrentControlSet\Control\WMI\Autologger\WdiContextLog@FileCounter 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\d053491d7780 Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\d053491d7780@90f1aae2aa22 0x9B 0xF4 0x2C 0xE7 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\bthserv\Parameters\BluetoothControlPanelTasks@State 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\Dnscache\Parameters\Probe\{15159a02-c239-4405-8763-0f21e31cda01}@LastProbeTime 1472588310 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch@Epoch 15314 Reg HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Epoch2@Epoch 2948 Reg HKLM\SYSTEM\CurrentControlSet\Services\srvnet\Parameters@MajorSequence 96 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{615B8A1E-E2D5-4B44-865C-CE54A1713351}@LeaseObtainedTime 1472581074 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{615B8A1E-E2D5-4B44-865C-CE54A1713351}@T1 1472624274 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{615B8A1E-E2D5-4B44-865C-CE54A1713351}@T2 1472656674 Reg HKLM\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Interfaces\{615B8A1E-E2D5-4B44-865C-CE54A1713351}@LeaseTerminatesTime 1472667474 Reg HKLM\SYSTEM\CurrentControlSet\Services\Winmgmt\Parameters@ServiceDllUnloadOnStop 0 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer@GlobalAssocChangedCounter 127 Reg HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\Shutdown@CleanShutdown 1 Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug@StoreLocation C:\ProgramData\Microsoft\Windows\WER\ReportQueue\NonCritical_Microsoft Corpor_40fc6a5dd893dab26dfe35af743bbf36a5e8d_00000000_cab_08e12025 Reg HKCU\Software\Microsoft\Windows\Windows Error Reporting\Debug\UIHandles@CheckingForSolutionDialog 0x64 0x03 0x0A 0x00 ... ---- Disk sectors - GMER 2.2 ---- Disk \Device\Harddisk0\DR0 unknown MBR code ---- EOF - GMER 2.2 ----