GMER 1.0.15.15627 - http://www.gmer.net
Rootkit scan 2011-05-24 19:38:48
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 ST340015A rev.3.01
Running: cjq0rbq4.exe; Driver: C:\DOCUME~1\Admin\USTAWI~1\Temp\pwldypob.sys


---- System - GMER 1.0.15 ----

SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwClose [0xAE45C6B8]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwCreateKey [0xAE45C574]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwDeleteValueKey [0xAE45CA52]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwDuplicateObject [0xAE45C14C]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwOpenKey [0xAE45C64E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwOpenProcess [0xAE45C08C]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwOpenThread [0xAE45C0F0]
SSDT            \??\C:\DOCUME~1\Admin\USTAWI~1\Temp\ASFWHide                                                                             ZwQuerySystemInformation [0xF7AAB486]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwQueryValueKey [0xAE45C76E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwRestoreKey [0xAE45C72E]
SSDT            \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/ALWIL Software)                                    ZwSetValueKey [0xAE45C8AE]
SSDT            \??\C:\DOCUME~1\Admin\USTAWI~1\Temp\ASFWHide                                                                             ZwTerminateProcess [0xF7AAB6DA]

---- Kernel code sections - GMER 1.0.15 ----

?               System32\Drivers\hiber_WMILIB.SYS                                                                                        System nie może odnaleźć określonej ścieżki. !

---- User IAT/EAT - GMER 1.0.15 ----

IAT             C:\WINDOWS\system32\services.exe[576] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]             003D0002
IAT             C:\WINDOWS\system32\services.exe[576] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]                   003D0000
IAT             C:\Program Files\Alwil Software\Avast4\ashWebSv.exe[3088] @ C:\WINDOWS\system32\WS2_32.dll [ADVAPI32.dll!RegOpenKeyExA]  [00414EE0] C:\Program Files\Alwil Software\Avast4\ashWebSv.exe (avast! Web Scanner/ALWIL Software)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \FileSystem\Ntfs \Ntfs                                                                                                   aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                                                 aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                                                aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                                                aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                                              aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                 fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                                                 aswMon2.SYS (avast! File System Filter Driver for Windows XP/ALWIL Software)

---- EOF - GMER 1.0.15 ----