GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2011-01-07 14:26:36
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD1200JB-00GVA0 rev.08.02D08
Running: 95dxwv3i.exe; Driver: C:\DOCUME~1\LUK~1.TO-\USTAWI~1\Temp\pwlirpoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.text   C:\WINDOWS.0\system32\DRIVERS\nv4_mini.sys                                                          section is writeable [0xF7CD2360, 0x372FAD, 0xE8000020]
?       C:\WINDOWS.0\system32\drivers\mnpnrn.sys                                                            Nie można odnaleźć określonego pliku. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\Explorer.EXE [KERNEL32.dll!GetProcAddress]           [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress]    [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\msvcrt.dll [KERNEL32.dll!GetProcAddress]    [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\ole32.dll [KERNEL32.dll!GetProcAddress]     [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\NETAPI32.dll [KERNEL32.dll!GetProcAddress]  [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\WININET.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\USERENV.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\PSAPI.DLL [KERNEL32.dll!GetProcAddress]     [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\iphlpapi.dll [KERNEL32.dll!GetProcAddress]  [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\WS2_32.dll [KERNEL32.dll!GetProcAddress]    [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)
IAT     C:\WINDOWS.0\Explorer.EXE[1028] @ C:\WINDOWS.0\system32\WS2HELP.dll [KERNEL32.dll!GetProcAddress]   [5CFE7774] C:\WINDOWS.0\system32\ShimEng.dll (Shim Engine DLL/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device  \Driver\abp470n5 \Device\abp470n5                                                                   mnpnrn.sys

---- Files - GMER 1.0.15 ----

File    C:\Documents and Settings\Luk.TO-5104B14844F9\Pulpit\sality_regkeys.zip                             8050 bytes

---- EOF - GMER 1.0.15 ----