GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-05 16:52:15
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Scsi\viamraid1Port2Path0Target0Lun0 SAMSUNG_ rev.SU10
Running: 4mmp7ohq.exe; Driver: C:\DOCUME~1\MARCIN~1\USTAWI~1\Temp\kxlcauog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwAssignProcessToJobObject [0xF1A694B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwCreateThread [0xF1A697F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwDebugActiveProcess [0xF1A69AB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwDuplicateObject [0xF1A695D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwLoadDriver [0xF1A698B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwOpenProcess [0xF1A69350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwOpenThread [0xF1A69410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwProtectVirtualMemory [0xF1A69570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwQueueApcThread [0xF1A69630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSetContextThread [0xF1A69530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSetInformationThread [0xF1A694F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSetSecurityObject [0xF1A69670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSetSystemInformation [0xF1A69870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSuspendProcess [0xF1A693B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSuspendThread [0xF1A69430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwSystemDebugControl [0xF1A69830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwTerminateProcess [0xF1A69370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwTerminateThread [0xF1A69470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                              ZwWriteVirtualMemory [0xF1A695F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 440                                                                                      804E2AAC 12 Bytes  [B0, 93, A6, F1, 30, 94, A6, ...] {MOV AL, 0x93; CMPSB ; INT1 ; XOR [ESI-0x5967cf0f], DL; INT1 }
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                      section is writeable [0xF714B360, 0x5773B5, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1148] kernel32.dll!SetUnhandledExceptionFilter                            7C84495D 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                        eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                     epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                      fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                      eamon.sys (Amon monitor/ESET)

---- Files - GMER 1.0.15 ----

File            C:\Documents and Settings\Marcin Marecki\WapSter\AQQ Folder\Profiles\gnomek87\Themes\Jaro88PL - Gadu-Gadu\Skin\Standard\Back  0 bytes

---- EOF - GMER 1.0.15 ----