GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-11-18 22:11:02
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3250410AS rev.3.AAC
Running: hk0tcjn0.exe; Driver: C:\DOCUME~1\mdn\USTAWI~1\Temp\pxtdypoc.sys


---- System - GMER 1.0.15 ----

INT 0x01  \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.)               B984159A
INT 0x03  \SystemRoot\system32\DRIVERS\ati2mtag.sys (ATI Radeon WindowsNT Miniport Driver/ATI Technologies Inc.)               B9841655

---- Kernel code sections - GMER 1.0.15 ----

.text     C:\WINDOWS\system32\DRIVERS\ati2mtag.sys                                                                             section is writeable [0xB96C3000, 0x17D80E, 0xE8000020]
.text     C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                             section is writeable [0xA8279000, 0x3326E, 0xE8000020]
.pklstb   C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                             entry point in ".pklstb" section [0xA82BE000]
.relo2    C:\WINDOWS\system32\drivers\ACEDRV09.sys                                                                             unknown last section [0xA82DA000, 0x8E, 0x42000040]
.text     C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                               section is writeable [0xA7BDD300, 0x3AE88, 0xE8000020]
.text     C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                               section is writeable [0xBA380300, 0x1B7E, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text     C:\WINDOWS\System32\svchost.exe[1108] ntdll.dll!NtQueryInformationProcess                                            7C90D7E0 5 Bytes  JMP 0233ADCD 
.text     C:\WINDOWS\System32\svchost.exe[1108] NETAPI32.dll!NetpwPathCanonicalize                                             6FF4A3A9 5 Bytes  JMP 0233AD64 
.text     C:\WINDOWS\system32\svchost.exe[1200] ntdll.dll!NtQueryInformationProcess                                            7C90D7E0 5 Bytes  JMP 0082ADCD 
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] ntdll.dll!LdrLoadDll                                              7C9163A3 5 Bytes  JMP 01495B00 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] kernel32.dll!lstrlenW + 43                                        7C809ADC 7 Bytes  JMP 016D7B58 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] kernel32.dll!MapViewOfFileEx + 6A                                 7C80B990 7 Bytes  JMP 016D7B35 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] kernel32.dll!ValidateLocale + B1E8                                7C8449F8 7 Bytes  JMP 0149EF12 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] USER32.dll!GetWindowInfo                                          7E37C49C 5 Bytes  JMP 015FBBA6 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text     C:\Program Files\Mozilla Firefox\firefox.exe[6496] GDI32.dll!SetDIBitsToDevice + 209                                 77F19E04 7 Bytes  JMP 016D7AB6 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Registry - GMER 1.0.15 ----

Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                     
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                  C:\Program Files\DAEMON Tools Lite\
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                  0
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                               0xA5 0x0F 0xBC 0xFD ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                            
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                         0x20 0x01 0x00 0x00 ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                      0x15 0xC0 0x88 0x3B ...
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                      
Reg       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                0x92 0x7E 0x6F 0x1F ...
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                 
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                      C:\Program Files\DAEMON Tools Lite\
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                      0
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                   0xA5 0x0F 0xBC 0xFD ...
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)        
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                             0x20 0x01 0x00 0x00 ...
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                          0x15 0xC0 0x88 0x3B ...
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)  
Reg       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                    0x92 0x7E 0x6F 0x1F ...

---- EOF - GMER 1.0.15 ----