GMER 2.0.18454 - http://www.gmer.net
Rootkit scan 2013-02-08 10:44:57
Windows 6.1.7601  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 ST9250827AS rev.3.AAA 232,89GB
Running: 0hgv5mh3.exe; Driver: C:\Users\Quguar\AppData\Local\Temp\fgldrpog.sys


---- Kernel code sections - GMER 2.0 ----

.text  ntkrnlpa.exe!ZwSaveKey + 13D1                                                                      82691A09 1 Byte  [06]
.text  ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                             826CB352 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
?      C:\Users\Quguar\AppData\Local\Temp\mbr.sys                                                         Nie można odnaleźć określonego pliku. !

---- User IAT/EAT - GMER 2.0 ----

IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                    [73172494] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]               [73155624] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]              [731556E2] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                     [7317250F] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]           [73168573] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]             [73164D27] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]            [731650CE] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]           [731651A3] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]  [731666D0] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]            [731682CA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]       [73168819] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]     [7316907A] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]           [7316E21D] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)
IAT    C:\Windows\Explorer.EXE[1488] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]               [73164C59] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7600.16385_none_72fc7cbf861225ca\gdiplus.dll (Microsoft GDI+/Microsoft Corporation)

---- Registry - GMER 2.0 ----

Reg    HKLM\SYSTEM\ControlSet001\services\BTHPORT\Parameters\Keys\002243a3b026 (not active ControlSet)    
Reg    HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002243a3b026                        
Reg    HKLM\SYSTEM\ControlSet003\services\BTHPORT\Parameters\Keys\002243a3b026 (not active ControlSet)    

---- EOF - GMER 2.0 ----