GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-03 20:55:19
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 Maxtor_6Y080P0 rev.YAR41BW0
Running: tzq4xqod.exe; Driver: C:\DOCUME~1\Krystian\USTAWI~1\Temp\uwldapog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwAssignProcessToJobObject [0xEF1484B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwCreateThread [0xEF1487F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwDebugActiveProcess [0xEF148AB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwDuplicateObject [0xEF1485D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwLoadDriver [0xEF1488B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwOpenProcess [0xEF148350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwOpenThread [0xEF148410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwProtectVirtualMemory [0xEF148570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwQueueApcThread [0xEF148630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetContextThread [0xEF148530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetInformationThread [0xEF1484F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetSecurityObject [0xEF148670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetSystemInformation [0xEF148870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSuspendProcess [0xEF1483B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSuspendThread [0xEF148430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSystemDebugControl [0xEF148830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwTerminateProcess [0xEF148370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwTerminateThread [0xEF148470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwWriteVirtualMemory [0xEF1485F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntoskrnl.exe!_abnormal_termination + 440                                                            804E2A9C 12 Bytes  [B0, 83, 14, EF, 30, 84, 14, ...] {MOV AL, 0x83; ADC AL, 0xef; XOR [ESP+EDX+0x148830ef], AL; OUT DX, EAX}

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1676] kernel32.dll!SetUnhandledExceptionFilter  7C8449FD 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                              eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                           epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
---- Processes - GMER 1.0.15 ----

Library         c:\windows\system32\n (*** hidden *** ) @ C:\WINDOWS\system32\svchost.exe [1048]                    0x45670000                                                                                                                    

---- EOF - GMER 1.0.15 ----