GMER 2.1.19163 - http://www.gmer.net
Rootkit scan 2013-05-12 09:32:56
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 Hitachi_HTS545032B9A300 rev.PB3OC60F 298,09GB
Running: nmgk69p5.exe; Driver: C:\Users\Marzena\AppData\Local\Temp\uxliifow.sys


---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                                                              82E93A09 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                                                                82ECD1F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Real\RealPlayer\update\realsched.exe[1716] kernel32.dll!SetUnhandledExceptionFilter  76FDF4FB 5 Bytes  [33, C0, C2, 04, 00] {XOR EAX, EAX; RET 0x4}

---- User IAT/EAT - GMER 2.1 ----

IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipAlloc]                       [743224CB] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusStartup]                  [7430562E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdiplusShutdown]                 [743056EC] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipFree]                        [74322546] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDeleteGraphics]              [743185AA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDisposeImage]                [74314D5E] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageWidth]               [74315105] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipGetImageHeight]              [743151DA] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateBitmapFromHBITMAP]     [74316707] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCreateFromHDC]               [74318301] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetCompositingMode]          [74318850] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipSetInterpolationMode]        [743190B1] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipDrawImageRectI]              [7431E254] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll
IAT             C:\Windows\Explorer.EXE[1688] @ C:\Windows\Explorer.EXE [gdiplus.dll!GdipCloneImage]                  [74314C90] C:\Windows\WinSxS\x86_microsoft.windows.gdiplus_6595b64144ccf1df_1.1.7601.17825_none_72d273598668a06b\gdiplus.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \FileSystem\fastfat \Fat                                                                              fltmgr.sys

---- EOF - GMER 2.1 ----