GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-05-18 14:59:56
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-e Hitachi_HTS542525K9SA00 rev.BBFOC33P 232,88GB
Running: wv8rsogt.exe; Driver: C:\DOCUME~1\POMOST\USTAWI~1\Temp\fxtdqpow.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwNotifyChangeKey [0xA7EC5004]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwNotifyChangeMultipleKeys [0xA7EC50D4]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwOpenProcess [0xA7EC4D76]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwTerminateProcess [0xA7EC4E1E]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwTerminateThread [0xA7EC4EBA]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                       ZwWriteVirtualMemory [0xA7EC4F56]

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2E44                                                               8050472C 5 Bytes  [04, 50, EC, A7, D4]
.text           ntkrnlpa.exe!ZwCallbackReturn + 2E4A                                                               80504732 2 Bytes  [EC, A7] {IN AL, DX; CMPSD }

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Camera Assistant Software for Toshiba\CEC_MAIN.exe[2896] ntdll.dll!DbgBreakPoint  7C90120E 1 Byte  [90]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3936] ntdll.dll!LdrLoadDll                            7C91632D 5 Bytes  JMP 10001FFD C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3936] kernel32.dll!lstrlenW + 43                      7C809AEC 7 Bytes  JMP 01B10455 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3936] kernel32.dll!MapViewOfFileEx + 6A               7C80B9A0 7 Bytes  JMP 01B1049D C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3936] kernel32.dll!ValidateLocale + B648              7C844EE0 7 Bytes  JMP 01725A06 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[3936] GDI32.dll!SetDIBitsToDevice + 20A               77F19E14 7 Bytes  JMP 01B104C4 C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                             avgidsfilterx.sys
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                           avgtdix.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                            SynTP.sys
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                            SynTP.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                          avgtdix.sys
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                          avgtdix.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                        avgtdix.sys
AttachedDevice  \FileSystem\Fastfat \Fat                                                                           fltMgr.sys
AttachedDevice  \FileSystem\Fastfat \Fat                                                                           avgidsfilterx.sys

---- Registry - GMER 2.1 ----

Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@DeviceNotSelectedTimeout                 15
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@GDIProcessHandleQuota                    10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@Spooler                                  yes
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@swapdisk                                 
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@TransmissionRetryTimeout                 90
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@USERProcessHandleQuota                   10000
Reg             HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows@LoadAppInit_DLLs                         1

---- EOF - GMER 2.1 ----