GMER 1.0.15.15530 - http://www.gmer.net
Rootkit scan 2010-12-16 11:59:53
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 ST94019A rev.3.09
Running: ywpefkhz.exe; Driver: C:\DOKUME~1\UserX\Ustawienia lokalne\Temp\ufloqpoc.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwAssignProcessToJobObject [0xEE91C610]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwDebugActiveProcess [0xEE91CC10]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwDuplicateObject [0xEE91C730]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwOpenProcess [0xEE91C4B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwOpenThread [0xEE91C570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwProtectVirtualMemory [0xEE91C6D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwQueueApcThread [0xEE91C790]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwSetContextThread [0xEE91C690]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwSetInformationThread [0xEE91C650]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwSetSecurityObject [0xEE91C7D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwSuspendProcess [0xEE91C510]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwSuspendThread [0xEE91C590]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwTerminateProcess [0xEE91C4D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwTerminateThread [0xEE91C5D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                                                                  ZwWriteVirtualMemory [0xEE91C750]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET NOD32 Antivirus\ekrn.exe[1704] kernel32.dll!SetUnhandledExceptionFilter                                                7C8449FD 4 Bytes  [C2, 04, 00, 00]
.text           C:\Program Files\Mozilla Firefox\firefox.exe[1812] ntdll.dll!LdrLoadDll                                                                           7C9163A3 5 Bytes  JMP 004013F0 C:\Program Files\Mozilla Firefox\firefox.exe (Firefox/Mozilla Corporation)
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[3812] USER32.dll!TrackPopupMenu                                                             7E3B531E 5 Bytes  JMP 10402342 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                                            eamon.sys (Amon monitor/ESET)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                           SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                                                                           EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                           SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass1                                                                                                           EABFiltr.sys (QLB PS/2 Keyboard filter driver/Hewlett-Packard Company)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                                         epfwtdir.sys (ESET Antivirus Network Redirector/ESET)

---- Registry - GMER 1.0.15 ----

Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64854157-06FD-CB18-9DDF-15183B5840B8}                                   
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64854157-06FD-CB18-9DDF-15183B5840B8}@pacomjijieiciadlddgjfmdecimaeegk  0x6B 0x61 0x67 0x62 ...
Reg             HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{64854157-06FD-CB18-9DDF-15183B5840B8}@oaincknfabmeciljfcmfhfjbdckfjh    0x6B 0x61 0x68 0x62 ...

---- EOF - GMER 1.0.15 ----