GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-10 15:37:48
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 TOSHIBA_MK4025GAS rev.KA100A
Running: gmer.exe; Driver: C:\DOCUME~1\Acer3000\USTAWI~1\Temp\kwrcqpob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwAssignProcessToJobObject [0xF2FEC4B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwCreateThread [0xF2FEC7F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwDebugActiveProcess [0xF2FECAB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwDuplicateObject [0xF2FEC5D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwLoadDriver [0xF2FEC8B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwOpenProcess [0xF2FEC350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwOpenThread [0xF2FEC410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwProtectVirtualMemory [0xF2FEC570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwQueueApcThread [0xF2FEC630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSetContextThread [0xF2FEC530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSetInformationThread [0xF2FEC4F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSetSecurityObject [0xF2FEC670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSetSystemInformation [0xF2FEC870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSuspendProcess [0xF2FEC3B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSuspendThread [0xF2FEC430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwSystemDebugControl [0xF2FEC830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwTerminateProcess [0xF2FEC370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwTerminateThread [0xF2FEC470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                  ZwWriteVirtualMemory [0xF2FEC5F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2778                                                              80501FB0 12 Bytes  [B0, C3, FE, F2, 30, C4, FE, ...]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET Smart Security\ekrn.exe[212] kernel32.dll!SetUnhandledExceptionFilter  7C84495D 4 Bytes  [C2, 04, 00, 00]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2224] ntdll.dll!LdrLoadDll                           7C91632D 5 Bytes  JMP 01229720 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2224] kernel32.dll!VirtualAlloc                      7C809AF1 5 Bytes  JMP 0145E21B C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2224] kernel32.dll!MapViewOfFile                     7C80B9A5 5 Bytes  JMP 0145E1F4 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[2224] GDI32.dll!CreateDIBSection                     77F19E19 5 Bytes  JMP 0145E17E C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                            eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                          epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                         epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                         epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                       epfwtdi.sys (ESET Personal Firewall TDI filter/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                          eamon.sys (Amon monitor/ESET)

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                             PE file @ sector 78124095

---- EOF - GMER 1.0.15 ----