GMER 1.0.15.15641 - http://www.gmer.net
Rootkit quick scan 2012-11-18 00:46:50
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 ST916082 rev.3.AA
Running: 1eu9l2bk.exe; Driver: C:\DOCUME~1\ADMINI~1\USTAWI~1\Temp\uwtdapow.sys


---- System - GMER 1.0.15 ----

SSDT            sptd.sys                                                      ZwEnumerateKey [0xF74F2FB2]
SSDT            sptd.sys                                                      ZwEnumerateValueKey [0xF74F3340]

Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwDeleteKey [0xBA7BFF4A]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwDeleteValueKey [0xBA7BFF76]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwMapViewOfSection [0xBA7BFFCC]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwOpenProcess [0xBA7BFEF4]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwOpenThread [0xBA7BFF08]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwRenameKey [0xBA7BFF60]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwSetSecurityObject [0xBA7BFFA2]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwTerminateProcess [0xBA7BFFF6]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwUnmapViewOfSection [0xBA7BFFE2]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 ZwYieldExecution [0xBA7BFFB6]
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 NtMapViewOfSection
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 NtOpenProcess
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 NtOpenThread
Code            mfehidk.sys (McAfee Link Driver/McAfee, Inc.)                 NtSetSecurityObject

---- Devices - GMER 1.0.15 ----

Device          \Driver\iaStor \Device\Ide\iaStor0                            8A8451E8
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3                   [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort0                            [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\atapi \Device\Ide\IdePort1                            [F7833B40] atapi.sys[unknown section] {MOV EDX, [ESP+0x8]; LEA ECX, [ESP+0x4]; PUSH EAX; MOV EAX, ESP; PUSH EAX}
Device          \Driver\iaStor \Device\Ide\IAAStorageDevice-0                 8A8451E8
Device          \Driver\azy2tio4 \Device\Scsi\azy2tio41                       88F4C468
Device          \Driver\azy2tio4 \Device\Scsi\azy2tio41Port3Path0Target0Lun0  88F4C468
Device          \FileSystem\Ntfs \Ntfs                                        8A8441E8

AttachedDevice  \FileSystem\Ntfs \Ntfs                                        mfehidk.sys (McAfee Link Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Ip                                      mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                     mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                     mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                   mfetdi2k.sys (Anti-Virus Mini-Firewall Driver/McAfee, Inc.)

---- EOF - GMER 1.0.15 ----