GMER 2.2.19882 - http://www.gmer.net
Rootkit scan 2016-08-18 22:43:45
Windows 5.1.2600 Dodatek Service Pack 3 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 WDC_WD10EARX-00N0YB0 rev.51.0AB51 931,51GB
Running: nc3lufyp.exe; Driver: C:\DOCUME~1\XP\USTAWI~1\Temp\uwldykob.sys


---- Kernel code sections - GMER 2.2 ----

.sfrelocÿÿÿÿsfsync04unknown last section [0xF7886000, 0xBC6, 0x40000040]  C:\WINDOWS\system32\drivers\sfsync04.sys                                                              unknown last section [0xF7886000, 0xBC6, 0x40000040]

---- User code sections - GMER 2.2 ----

.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] ntdll.dll!LdrLoadDll                               7C915C35 5 Bytes  JMP 10001980 C:\Program Files\Mozilla Firefox\mozglue.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] kernel32.dll!lstrlenW + 43                         7C809AEC 7 Bytes  JMP 0189B410 C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] kernel32.dll!MapViewOfFileEx + 6A                  7C80B9A0 7 Bytes  JMP 0189A6D5 C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] kernel32.dll!ValidateLocale + B648                 7C844EE0 7 Bytes  JMP 015E6F9D C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] GDI32.dll!SetDIBitsToDevice + 20A                  77F19E14 7 Bytes  JMP 01899F8B C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] USER32.dll!GetWindowInfo                           7E37C49C 5 Bytes  JMP 023D6CA8 C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] USER32.dll!CreateWindowExW                         7E37D0A3 5 Bytes  JMP 015C2749 C:\Program Files\Mozilla Firefox\xul.dll
.text                                                                     C:\Program Files\Mozilla Firefox\firefox.exe[1628] USER32.dll!CreateWindowExA                         7E37E4A9 5 Bytes  JMP 01986EED C:\Program Files\Mozilla Firefox\xul.dll

---- Devices - GMER 2.2 ----

AttachedDevice                                                            \Driver\Tcpip \Device\Tcp                                                                             aswRdr.sys

---- Registry - GMER 2.2 ----

Reg                                                                       HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg                                                                       HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg                                                                       HKLM\SYSTEM\ControlSet001\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x79 0xD8 0xDE 0x6D ...
Reg                                                                       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg                                                                       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg                                                                       HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x79 0xD8 0xDE 0x6D ...
Reg                                                                       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg                                                                       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg                                                                       HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x79 0xD8 0xDE 0x6D ...
Reg                                                                       HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg                                                                       HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg                                                                       HKLM\SYSTEM\ControlSet004\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x79 0xD8 0xDE 0x6D ...
Reg                                                                       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC                      
Reg                                                                       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                   0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                   0
Reg                                                                       HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                0x79 0xD8 0xDE 0x6D ...
Reg                                                                       HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet)  
Reg                                                                       HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0                       0xD4 0xC3 0x97 0x02 ...
Reg                                                                       HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0                       0
Reg                                                                       HKLM\SYSTEM\ControlSet006\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12                    0x79 0xD8 0xDE 0x6D ...

---- EOF - GMER 2.2 ----