GMER 2.1.19357 - http://www.gmer.net
Rootkit scan 2015-04-20 16:46:48
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-8 ST1000DM003-1CH162 rev.CC47 931,51GB
Running: dn8odr5z.exe; Driver: C:\DOCUME~1\bb\USTAWI~1\Temp\kgwyyfoc.sys


---- Kernel code sections - GMER 2.1 ----

.text  C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                         section is writeable [0xB49D03C0, 0x843B7A, 0xE8000020]

---- User code sections - GMER 2.1 ----

.text  C:\WINDOWS\Explorer.EXE[1800] SHELL32.dll!StrStrW                                                7C9CEF18 8 Bytes  [80, 11, 60, 19, C0, 11, 60, ...] {ADC BYTE [ECX], 0x60; SBB EAX, EAX; ADC [EAX+0x19], ESP}
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtCreateFile                        7C90D0AE 5 Bytes  JMP 00FCF912 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtFlushBuffersFile                  7C90D32E 5 Bytes  JMP 00FCF652 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtQueryFullAttributesFile           7C90D7AE 5 Bytes  JMP 00FCF78A C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtReadFile                          7C90D9CE 5 Bytes  JMP 00FCF68C C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtReadFileScatter                   7C90D9DE 5 Bytes  JMP 015743A6 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtWriteFile                         7C90DF7E 5 Bytes  JMP 00FCFAB6 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!NtWriteFileGather                   7C90DF8E 5 Bytes  JMP 015743F6 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] ntdll.dll!LdrLoadDll                          7C91632D 5 Bytes  JMP 1000908C C:\Program Files\Mozilla Firefox\mozglue.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] kernel32.dll!lstrlenW + 43                    7C809AEC 7 Bytes  JMP 0155FD1D C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] kernel32.dll!MapViewOfFileEx + 6A             7C80B9A0 7 Bytes  JMP 0155DDA1 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] kernel32.dll!ValidateLocale + B648            7C844EE0 7 Bytes  JMP 01301FD5 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] GDI32.dll!SetDIBitsToDevice + 20A             77F19E14 7 Bytes  JMP 0155C315 C:\Program Files\Mozilla Firefox\xul.dll
.text  C:\Program Files\Mozilla Firefox\firefox.exe[2720] USER32.dll!GetWindowInfo                      7E37C49C 5 Bytes  JMP 01F4BF0A C:\Program Files\Mozilla Firefox\xul.dll

---- Registry - GMER 2.1 ----

Reg    HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\0015830cbfeb                      
Reg    HKLM\SYSTEM\ControlSet002\Services\BTHPORT\Parameters\Keys\0015830cbfeb (not active ControlSet)  

---- EOF - GMER 2.1 ----