GMER 2.1.19357 - http://www.gmer.net Rootkit scan 2015-10-11 22:11:34 Windows 5.1.2600 Dodatek Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 SAMSUNG_HD161HJ rev.JF100-19 149,05GB Running: lt28jeqo.exe; Driver: C:\DOCUME~1\Tomek\USTAWI~1\Temp\ufpyafoc.sys ---- Kernel code sections - GMER 2.1 ---- .text C:\WINDOWS\system32\DRIVERS\nv4_mini.sys section is writeable [0xF6F28360, 0x24CB9D, 0xE8000020] ---- User code sections - GMER 2.1 ---- .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtCreateFile 7C90D682 5 Bytes JMP 0135B170 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtFlushBuffersFile 7C90D9CA 5 Bytes JMP 0135AF39 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtQueryFullAttributesFile 7C90DFB2 5 Bytes JMP 0135B063 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtReadFile 7C90E27C 5 Bytes JMP 0135AF73 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtReadFileScatter 7C90E291 5 Bytes JMP 016C0CDC C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtWriteFile 7C90E9F3 5 Bytes JMP 0135B314 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!NtWriteFileGather 7C90EA08 5 Bytes JMP 016C0D2C C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!RtlAllocateHeap + 270 7C910844 7 Bytes JMP 00414A6C C:\Program Files\Mozilla Firefox\firefox.exe .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] ntdll.dll!LdrLoadDll 7C9161CA 5 Bytes JMP 1000A961 C:\Program Files\Mozilla Firefox\mozglue.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] kernel32.dll!lstrlenW + 43 7C809A7C 7 Bytes JMP 016A9E1C C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] kernel32.dll!MapViewOfFileEx + 6A 7C80B788 7 Bytes JMP 016A92F8 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] kernel32.dll!lstrcpyn + 70 7C810381 7 Bytes JMP 0141CD39 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] USER32.dll!GetWindowInfo 77D3F122 5 Bytes JMP 02204DC5 C:\Program Files\Mozilla Firefox\xul.dll .text C:\Program Files\Mozilla Firefox\firefox.exe[1420] GDI32.dll!SetWindowOrgEx + 15E 77F1960B 7 Bytes JMP 016A8ACC C:\Program Files\Mozilla Firefox\xul.dll ---- EOF - GMER 2.1 ----