GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-10-14 19:31:01
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\00000070 SAMSUNG_HD321KJ rev.CP100-10
Running: z9v9cycq.exe; Driver: C:\DOCUME~1\Krystek\USTAWI~1\Temp\fxryqpoc.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwNotifyChangeKey [0xB962F004]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwNotifyChangeMultipleKeys [0xB962F0D4]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwOpenProcess [0xB962ED76]
SSDT            \??\C:\WINDOWS\system32\drivers\avgtpx86.sys (AVG Technologies)                                                              ZwQueryValueKey [0xF76D8258]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateProcess [0xB962EE1E]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwTerminateThread [0xB962EEBA]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies CZ, s.r.o. )  ZwWriteVirtualMemory [0xB962EF56]

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2DA0                                                                                         8050463C 2 Bytes  [04, F0] {ADD AL, 0xf0}
.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                     section is writeable [0xF6C18360, 0x24526E, 0xE8000020]
init            C:\WINDOWS\system32\drivers\Senfilt.sys                                                                                      entry point in "init" section [0xF6961A00]
.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                                       section is writeable [0xB9528300, 0x3AF78, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                                       section is writeable [0xF773F300, 0x1BCE, 0xE8000020]

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                       avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                     avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                    avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                    avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                                  avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                     fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                     avgidsfilterx.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies CZ, s.r.o. )

---- Threads - GMER 1.0.15 ----

Thread          System [4:356]                                                                                                               85E0A0F4

---- EOF - GMER 1.0.15 ----