GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-11-03 00:56:02
Windows 5.1.2600 Dodatek Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-5 WDC_WD2000JS-00MHB0 rev.02.01C03
Running: lyn6qk1h.exe; Driver: C:\DOCUME~1\Ja\USTAWI~1\Temp\pfayifow.sys


---- Kernel code sections - GMER 1.0.15 ----

.text   C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                                              section is writeable [0xB433A380, 0x5414D5, 0xE8000020]
.text   C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                                                                section is writeable [0xAF981300, 0x3ACC8, 0xE8000020]
.text   C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                                                                section is writeable [0xB02BB300, 0x1B7E, 0xE8000020]

---- User code sections - GMER 1.0.15 ----

.text   E:\Programy użytkowe\Kies\External\FirmwareUpdate\KiesPDLR.exe[1604] ntdll.dll!DbgUiRemoteBreakin                                     7C951E0B 1 Byte  [C3]

---- Devices - GMER 1.0.15 ----

Device  \Driver\prodrv06 \Device\ProDrv06                                                                                                     E1C272B8
Device  \Driver\atapi \Device\Ide\IdePort0                                                                                                    sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\atapi \Device\Ide\IdePort1                                                                                                    sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\atapi \Device\Ide\IdePort2                                                                                                    sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\atapi \Device\Ide\IdePort3                                                                                                    sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-5                                                                                           sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device  \Driver\atapi \Device\Ide\IdeDeviceP2T0L0-12                                                                                          sfsync02.sys (StarForce Protection Synchronization Driver/Protection Technology)
Device                                                                                                                                        ACPI.sys (Sterownik ACPI dla systemu NT/Microsoft Corporation)
Device  \Driver\prohlp02 \Device\ProHlp02                                                                                                     E16C5768

---- Registry - GMER 1.0.15 ----

Reg     HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000a3a6e4d58                                                           
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4                                                      
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                   E:\Programy u?ytkowe\DaemonTools\DAEMON Tools\
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                   0
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                                0x0A 0x29 0xC3 0x37 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001                                             
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                          0x20 0x01 0x00 0x00 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                       0x91 0x3F 0xA0 0x57 ...
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40                                       
Reg     HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                                 0x76 0x1B 0xA2 0xEE ...
Reg     HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\000a3a6e4d58 (not active ControlSet)                                       
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet)                                  
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0                                                       E:\Programy u?ytkowe\DaemonTools\DAEMON Tools\
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0                                                       0
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh                                                    0x0A 0x29 0xC3 0x37 ...
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet)                         
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0                                              0x20 0x01 0x00 0x00 ...
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh                                           0x91 0x3F 0xA0 0x57 ...
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet)                   
Reg     HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh                                     0x76 0x1B 0xA2 0xEE ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{445A672B-4FF8-FA1E-5A58-749BEE1EA3B1}                       
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{445A672B-4FF8-FA1E-5A58-749BEE1EA3B1}@jaemfflniejmlbmpklia  0x6B 0x61 0x62 0x64 ...
Reg     HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{445A672B-4FF8-FA1E-5A58-749BEE1EA3B1}@jalmemdbldbddpbakaab  0x69 0x61 0x62 0x64 ...

---- EOF - GMER 1.0.15 ----