GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2014-08-30 11:18:31
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST3320418AS rev.CC37 298,09GB
Running: xd8m3oyi.exe; Driver: C:\DOCUME~1\user\USTAWI~1\Temp\fxwyipod.sys


---- System - GMER 2.1 ----

SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwNotifyChangeKey [0xB84816E0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwNotifyChangeMultipleKeys [0xB8481800]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwOpenProcess [0xB8481010]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwOpenThread [0xB84814D0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwSuspendProcess [0xB8481300]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwSuspendThread [0xB84813E0]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwTerminateProcess [0xB8481120]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwTerminateThread [0xB8481210]
SSDT            \SystemRoot\system32\DRIVERS\avgidsshimx.sys                                                      ZwWriteVirtualMemory [0xB84815E0]

---- Kernel code sections - GMER 2.1 ----

.text           C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                          section is writeable [0xB755C360, 0x3D46A5, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\atksgt.sys                                                            section is writeable [0xB3E43300, 0x3B6D8, 0xE8000020]
.text           C:\WINDOWS\system32\DRIVERS\lirsgt.sys                                                            section is writeable [0xB8468300, 0x1BEE, 0xE8000020]

---- User code sections - GMER 2.1 ----

.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtCreateFile                          7C90D0AE 5 Bytes  JMP 018D3D20 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtFlushBuffersFile                    7C90D32E 5 Bytes  JMP 018BC661 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtQueryFullAttributesFile             7C90D7AE 5 Bytes  JMP 018D3820 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtReadFile                            7C90D9CE 5 Bytes  JMP 018BC750 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtReadFileScatter                     7C90D9DE 5 Bytes  JMP 0215E1FF C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtWriteFile                           7C90DF7E 5 Bytes  JMP 018D43D0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!NtWriteFileGather                     7C90DF8E 5 Bytes  JMP 0215E1AE C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] ntdll.dll!LdrLoadDll                            7C91632D 5 Bytes  JMP 10001F4C C:\Program Files\Mozilla Firefox\mozglue.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] kernel32.dll!lstrlenW + 43                      7C809AEC 7 Bytes  JMP 020FF582 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] kernel32.dll!MapViewOfFileEx + 6A               7C80B9A0 7 Bytes  JMP 020FF55F C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] kernel32.dll!ValidateLocale + B648              7C844EE0 7 Bytes  JMP 018D06F3 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] GDI32.dll!SetDIBitsToDevice + 20A               77F19E14 7 Bytes  JMP 020FF4E0 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\firefox.exe[676] USER32.dll!GetWindowInfo                        7E37C49C 5 Bytes  JMP 0200E5A9 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[1776] USER32.dll!DefWindowProcA + 11A       7E37C298 7 Bytes  JMP 105244B6 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[1776] USER32.dll!SetWindowLongA + 19        7E37C2B6 7 Bytes  JMP 10524527 C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[1776] USER32.dll!GetWindowInfo              7E37C49C 5 Bytes  JMP 1052825D C:\Program Files\Mozilla Firefox\xul.dll
.text           C:\Program Files\Mozilla Firefox\plugin-container.exe[1776] USER32.dll!GetMenuContextHelpId + 1A  7E3B5319 7 Bytes  JMP 10521BFA C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                          avgtdix.sys
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                         avgtdix.sys
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                         avgtdix.sys
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                       avgtdix.sys

---- EOF - GMER 2.1 ----