GMER 1.0.15.15640 - http://www.gmer.net
Rootkit scan 2011-05-30 22:32:52
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 HTS541060G9SA00 rev.MB3OC60R
Running: bgb2kuor.exe; Driver: C:\DOCUME~1\Doris\USTAWI~1\Temp\uwtdqpob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwAssignProcessToJobObject [0xAA631610]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwDebugActiveProcess [0xAA631C10]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwDuplicateObject [0xAA631730]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwOpenProcess [0xAA6314B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwOpenThread [0xAA631570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwProtectVirtualMemory [0xAA6316D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwQueueApcThread [0xAA631790]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwSetContextThread [0xAA631690]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwSetInformationThread [0xAA631650]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwSetSecurityObject [0xAA6317D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwSuspendProcess [0xAA631510]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwSuspendThread [0xAA631590]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwTerminateProcess [0xAA6314D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwTerminateThread [0xAA6315D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                   ZwWriteVirtualMemory [0xAA631750]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2448                                                               80501C80 2 Bytes  [10, 1C]
init            C:\WINDOWS\system32\drivers\tifm21.sys                                                             entry point in "init" section [0xF7E85EBF]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[904] kernel32.dll!SetUnhandledExceptionFilter  7C844935 4 Bytes  [C2, 04, 00, 00]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                             eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                          epfwtdir.sys (ESET Antivirus Network Redirector/ESET)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                           eamon.sys (Amon monitor/ESET)

Device          \FileSystem\Cdfs \Cdfs                                                                             A9F19400

---- EOF - GMER 1.0.15 ----