GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2011-11-21 20:11:02
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e ST3500418AS rev.CC38
Running: i6x8x3fz.exe; Driver: C:\DOCUME~1\Piotr\USTAWI~1\Temp\fwroqfod.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwAssignProcessToJobObject [0xB2562610]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDebugActiveProcess [0xB2562C10]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDuplicateObject [0xB2562730]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenProcess [0xB25624B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenThread [0xB2562570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwProtectVirtualMemory [0xB25626D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwQueueApcThread [0xB2562790]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetContextThread [0xB2562690]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetInformationThread [0xB2562650]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetSecurityObject [0xB25627D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendProcess [0xB2562510]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendThread [0xB2562590]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateProcess [0xB25624D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateThread [0xB25625D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwWriteVirtualMemory [0xB2562750]

---- Kernel code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                              section is writeable [0xB6FDD380, 0x3DEB95, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                section is writeable [0xAD5DB300, 0x3AF78, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                section is writeable [0xB8448300, 0x1BCE, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[696] ntdll.dll!LdrLoadDll                                7C9161CA 5 Bytes  JMP 012A2EC0 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1152] kernel32.dll!SetUnhandledExceptionFilter    7C8447ED 4 Bytes  [C2, 04, 00, 00]
.text           C:\Program Files\Tunngle\TnglCtrl.exe[1480] ntdll.dll!DbgBreakPoint                                   7C901230 1 Byte  [90]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                             epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume1                                                                hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume2                                                                hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)
AttachedDevice  \Driver\Ftdisk \Device\HarddiskVolume3                                                                hotcore3.sys (A part of Paragon System Utilities/Paragon Software Group)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                   0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                   0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                0xE2 0x66 0xE3 0x4A ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0xE2 0x66 0xE3 0x4A ...

---- EOF - GMER 1.0.15 ----