GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-09-20 18:50:08
Windows 6.1.7600 
Running: u4dztu0i.exe; Driver: C:\Users\lukas\AppData\Local\Temp\kwdyqkog.sys


---- System - GMER 1.0.15 ----

INT 0x1F        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             82829AF8
INT 0x37        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             82829104
INT 0xC1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             828293F4
INT 0xD1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             828122D8
INT 0xD2        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             82811898
INT 0xDF        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             828291DC
INT 0xE1        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             82829958
INT 0xE3        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             828296F8
INT 0xFD        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             82829F2C
INT 0xFE        \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)                             8282A1A8

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwSaveKeyEx + 13AD                                                                                      82889579 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                               828ADF52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           peauth.sys                                                                                                           94A1DC9D 28 Bytes  [0F, 22, 1A, 2A, 5F, BC, DD, ...]
.text           peauth.sys                                                                                                           94A1DCC1 28 Bytes  [0F, 22, 1A, 2A, 5F, BC, DD, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 4F90                                                                                  94BA4000 98 Bytes  [8B, FF, 55, 8B, EC, 33, C0, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 4FF3                                                                                  94BA4063 49 Bytes  [94, 8B, 45, 08, F0, 0F, BA, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5025                                                                                  94BA4095 141 Bytes  JMP 828825D0 \SystemRoot\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation)
PAGE            spsys.sys!?SPRevision@@3PADA + 50B3                                                                                  94BA4123 629 Bytes  [F5, B9, 94, FE, 05, 34, F5, ...]
PAGE            spsys.sys!?SPRevision@@3PADA + 5329                                                                                  94BA4399 101 Bytes  [6A, 28, 59, A5, 5E, C6, 03, ...]
PAGE            ...                                                                                                                  

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress]  [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress]    [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress]     [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress]   [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress]   [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress]   [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)
IAT             C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress]   [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000044                                                                                    halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                               fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                                                                               rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                               fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                                                                               rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                               fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                                                                               rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- Disk sectors - GMER 1.0.15 ----

Disk            \Device\Harddisk0\DR0                                                                                                sector 61: copy of MBR
Disk            \Device\Harddisk0\DR0                                                                                                sector 62: copy of MBR

---- EOF - GMER 1.0.15 ----