GMER 1.0.15.15530 - http://www.gmer.net Rootkit scan 2011-01-05 12:09:10 Windows 6.1.7100 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 WDC_WD3200BEVS-26VAT0 rev.11.01A11 Running: qckk6vox.exe; Driver: C:\Users\Renia\AppData\Local\Temp\kwlcrpod.sys ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwSaveKeyEx + 13B1 82C4B549 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 82C6B6B2 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text C:\Windows\system32\DRIVERS\atikmdag.sys section is writeable [0x9140F000, 0x2D5378, 0xE8000020] ---- User code sections - GMER 1.0.15 ---- .text C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1684] kernel32.dll!SetUnhandledExceptionFilter 76B130AA 4 Bytes [C2, 04, 00, 00] ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc] [73C7245E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup] [73C555EF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown] [73C556AD] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree] [73C724D9] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics] [73C6853B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage] [73C64CEF] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth] [73C65096] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight] [73C6516B] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP] [73C66698] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC] [73C68292] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode] [73C687E1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode] [73C69044] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI] [73C6E1E7] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) IAT C:\Windows\Explorer.EXE[1652] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage] [73C64C21] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7100.0_none_69badf24eb1ea50c\gdiplus.dll (Microsoft GDI+/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 Wdf01000.sys (Aparat wykonawczy struktury sterowników trybu jądra/Microsoft Corporation) AttachedDevice \Driver\kbdclass \Device\KeyboardClass1 Wdf01000.sys (Aparat wykonawczy struktury sterowników trybu jądra/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) Device \Driver\ACPI_HAL \Device\0000005e halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\001986002c30 Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\001986002c30 (not active ControlSet) ---- EOF - GMER 1.0.15 ----