Ihavenet-Trojaner

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-07-29 16:55:15
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Hitachi_ rev.JE4O 698,64GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Meike\AppData\Local\Temp\kwtdipow.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                            fffff800033a7000 45 bytes [00, 00, 08, 02, 53, 65, 6D, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607                                                                            fffff800033a702f 16 bytes [00, 01, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[2040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   0000000075a71465 2 bytes [A7, 75]
.text     C:\Program Files (x86)\CyberLink\PowerDVD10\Device\MediaServer\CLMSServer.exe[2040] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  0000000075a714bb 2 bytes [A7, 75]
.text     ...                                                                                                                                           * 2
.text     C:\Program Files (x86)\Samsung\Kies\Kies.exe[3004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                    0000000075a71465 2 bytes [A7, 75]
.text     C:\Program Files (x86)\Samsung\Kies\Kies.exe[3004] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                   0000000075a714bb 2 bytes [A7, 75]
.text     ...                                                                                                                                           * 2
.text     C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[3372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000075a71465 2 bytes [A7, 75]
.text     C:\Program Files (x86)\CyberLink\PowerDVD10\PDVD10Serv.exe[3372] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                     0000000075a714bb 2 bytes [A7, 75]
.text     ...                                                                                                                                           * 2
.text     C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                             0000000075a71465 2 bytes [A7, 75]
.text     C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe[4320] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                            0000000075a714bb 2 bytes [A7, 75]
.text     ...                                                                                                                                           * 2
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000075a71465 2 bytes [A7, 75]
.text     C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[5608] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155           0000000075a714bb 2 bytes [A7, 75]
.text     ...                                                                                                                                           * 2

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac728963258a                                                                   
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\ac728963258a@a0759155aa43                                                      0x1A 0x46 0x92 0x28 ...
Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\bc77372408e1                                                                   
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac728963258a (not active ControlSet)                                               
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\ac728963258a@a0759155aa43                                                          0x1A 0x46 0x92 0x28 ...
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\bc77372408e1 (not active ControlSet)                                               

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                         unknown MBR code

---- EOF - GMER 2.1 ----