GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-07-17 12:02:13
Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\0000005e WDC_WD800JB-00FMA0 rev.13.03G13
Running: rtpe503r.exe; Driver: C:\DOCUME~1\Tata\USTAWI~1\Temp\afdyrfoc.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwAssignProcessToJobObject [0xAE7694B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwCreateThread [0xAE7697F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDebugActiveProcess [0xAE769AB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDuplicateObject [0xAE7695D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwLoadDriver [0xAE7698B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenProcess [0xAE769350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenThread [0xAE769410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwProtectVirtualMemory [0xAE769570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwQueueApcThread [0xAE769630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetContextThread [0xAE769530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetInformationThread [0xAE7694F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetSecurityObject [0xAE769670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetSystemInformation [0xAE769870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendProcess [0xAE7693B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendThread [0xAE769430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSystemDebugControl [0xAE769830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateProcess [0xAE769370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateThread [0xAE769470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwWriteVirtualMemory [0xAE7695F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2720                                                                  80501424 12 Bytes  [B0, 93, 76, AE, 30, 94, 76, ...] {MOV AL, 0x93; JBE 0xffffffffffffffb2; XOR [ESI+ESI*2+0x769830ae], DL; SCASB }
.text           C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                              section is writeable [0xF67F6000, 0x1C5D38, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\Real\RealPlayer\update\realsched.exe[188] kernel32.dll!SetUnhandledExceptionFilter   7C810386 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}
.text           C:\Program Files\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe[364] ntdll.dll!DbgUiRemoteBreakin  7C95077B 1 Byte  [C3]
.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1776] kernel32.dll!SetUnhandledExceptionFilter    7C810386 4 Bytes  [C2, 04, 00, 00]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3364] ntdll.dll!LdrLoadDll                               7C9161CA 5 Bytes  JMP 0115FA35 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3364] kernel32.dll!VirtualAlloc                          7C809A81 5 Bytes  JMP 014007C5 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3364] kernel32.dll!MapViewOfFile                         7C80B78D 5 Bytes  JMP 0140079E C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3364] GDI32.dll!CreateDIBSection                         77F19610 5 Bytes  JMP 01400728 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                             epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                              eamon.sys (Amon monitor/ESET)

---- EOF - GMER 1.0.15 ----