GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-12-22 00:31:56
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD800BB-00JHC0 rev.05.01C05
Running: i6drp6bi.exe; Driver: C:\DOCUME~1\xp\USTAWI~1\Temp\pwtdykog.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwAssignProcessToJobObject [0xF136A610]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDebugActiveProcess [0xF136AC10]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwDuplicateObject [0xF136A730]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenProcess [0xF136A4B0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwOpenThread [0xF136A570]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwProtectVirtualMemory [0xF136A6D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwQueueApcThread [0xF136A790]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetContextThread [0xF136A690]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetInformationThread [0xF136A650]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSetSecurityObject [0xF136A7D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendProcess [0xF136A510]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwSuspendThread [0xF136A590]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateProcess [0xF136A4D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwTerminateThread [0xF136A5D0]
SSDT            \SystemRoot\system32\DRIVERS\ehdrv.sys (ESET Helper driver/ESET)                                      ZwWriteVirtualMemory [0xF136A750]

---- User code sections - GMER 1.0.15 ----

.text           C:\Program Files\ESET\ESET Smart Security\ekrn.exe[800] kernel32.dll!SetUnhandledExceptionFilter      7C8449CD 4 Bytes  [C2, 04, 00, 00]
.text           C:\Program Files\CometBird\cometbird.exe[3044] ntdll.dll!LdrLoadDll                                   7C91632D 5 Bytes  JMP 00E2EF34 C:\Program Files\CometBird\xul.dll (CometNetwork)
.text           C:\Program Files\CometBird\cometbird.exe[3044] kernel32.dll!VirtualAlloc                              7C809AF1 5 Bytes  JMP 015C06EA C:\Program Files\CometBird\xul.dll (CometNetwork)
.text           C:\Program Files\CometBird\cometbird.exe[3044] kernel32.dll!MapViewOfFile                             7C80B9A5 5 Bytes  JMP 015C0732 C:\Program Files\CometBird\xul.dll (CometNetwork)
.text           C:\Program Files\CometBird\cometbird.exe[3044] GDI32.dll!CreateDIBSection                             77F19E19 5 Bytes  JMP 015C0759 C:\Program Files\CometBird\xul.dll (CometNetwork)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                eamon.sys (Amon monitor/ESET)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                   0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                   0
Reg             HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                0x8E 0xFB 0x63 0x8A ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0x00 0x00 0x00 0x00 ...
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg             HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x8E 0xFB 0x63 0x8A ...