GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-07-26 11:24:30
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST3250318AS rev.CC38 232,88GB
Running: 1vgni5dz.exe; Driver: C:\DOCUME~1\Olga\USTAWI~1\Temp\fwtdapod.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwAssignProcessToJobObject [0xA8912610]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwDebugActiveProcess [0xA8912C10]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwDuplicateObject [0xA8912730]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwOpenProcess [0xA89124B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwOpenThread [0xA8912570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwProtectVirtualMemory [0xA89126D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwQueueApcThread [0xA8912790]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetContextThread [0xA8912690]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetInformationThread [0xA8912650]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSetSecurityObject [0xA89127D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSuspendProcess [0xA8912510]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwSuspendThread [0xA8912590]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwTerminateProcess [0xA89124D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwTerminateThread [0xA89125D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                    ZwWriteVirtualMemory [0xA8912750]

Code            \??\C:\DOCUME~1\Olga\USTAWI~1\Temp\catchme.sys                                                      pIofCallDriver

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 307D                                                                80504965 7 Bytes  [25, 91, A8, 90, 25, 91, A8]
.text           ntkrnlpa.exe!ZwCallbackReturn + 308C                                                                80504974 5 Bytes  [D0, 24, 91, A8, D0] {SHL BYTE [ECX+EDX*4], 0x1; TEST AL, 0xd0}
.text           ntkrnlpa.exe!ZwCallbackReturn + 3092                                                                8050497A 2 Bytes  [91, A8]
?               C:\WINDOWS\system32\Drivers\PROCEXP113.SYS                                                          Nie można odnaleźć określonego pliku. !
?               C:\DOCUME~1\Olga\USTAWI~1\Temp\catchme.sys                                                          System nie może odnaleźć określonej ścieżki. !

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1652] kernel32.dll!SetUnhandledExceptionFilter  7C8449CD 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                              eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                           epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                            fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                            eamon.sys (Amon monitor/ESET)

---- EOF - GMER 2.1 ----