GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-09-01 10:28:40
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-e WDC_WD800JD-60LSA5 rev.10.01E03
Running: pli567g0.exe; Driver: C:\DOCUME~1\Fosomaks\USTAWI~1\Temp\pgtdypow.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwAssignProcessToJobObject [0xAA1594B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwCreateThread [0xAA1597F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwDebugActiveProcess [0xAA159AB0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwDuplicateObject [0xAA1595D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwLoadDriver [0xAA1598B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwOpenProcess [0xAA159350]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwOpenThread [0xAA159410]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwProtectVirtualMemory [0xAA159570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwQueueApcThread [0xAA159630]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSetContextThread [0xAA159530]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSetInformationThread [0xAA1594F0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSetSecurityObject [0xAA159670]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSetSystemInformation [0xAA159870]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSuspendProcess [0xAA1593B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSuspendThread [0xAA159430]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwSystemDebugControl [0xAA159830]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwTerminateProcess [0xAA159370]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwTerminateThread [0xAA159470]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                            ZwWriteVirtualMemory [0xAA1595F0]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2FD0                                                                                        80504888 12 Bytes  [B0, 93, 15, AA, 30, 94, 15, ...]
PAGE            ntkrnlpa.exe!ZwResumeThread                                                                                                 805D4A18 1 Byte  [CC] {INT 3 }
.text           atapi.sys                                                                                                                   F73EF852 1 Byte  [CC] {INT 3 }

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[328] kernel32.dll!SetUnhandledExceptionFilter                           7C84495D 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                      eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                   epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

---- Threads - GMER 1.0.15 ----

Thread          System [4:368]                                                                                                              864E239F
Thread          System [4:964]                                                                                                              85C9A0F4

---- Registry - GMER 1.0.15 ----

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A                                                      
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\A@BaseClass                                            Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C                                                      
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\C@BaseClass                                            Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D                                                      
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\D@BaseClass                                            Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E                                                      
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\E@BaseClass                                            Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F                                                      
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F@BaseClass                                            Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ed9538e-c7df-11df-9f71-806d6172696f}                 
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ed9538e-c7df-11df-9f71-806d6172696f}@BaseClass       Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3ed9538e-c7df-11df-9f71-806d6172696f}@_AutorunStatus  0x01 0x00 0x01 0x00 ...
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa12-c64e-11df-bab9-806d6172696f}                 
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa12-c64e-11df-bab9-806d6172696f}@BaseClass       Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa13-c64e-11df-bab9-806d6172696f}                 
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa13-c64e-11df-bab9-806d6172696f}@BaseClass       Drive
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa14-c64e-11df-bab9-9e1cde989dc8}                 
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{87c5aa14-c64e-11df-bab9-9e1cde989dc8}@BaseClass       Drive

---- EOF - GMER 1.0.15 ----