GMER 2.0.18444 - http://www.gmer.net
Rootkit scan 2013-01-11 17:55:53
Windows 5.1.2600 Dodatek Service Pack 2 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-4 WDC_WD800BB-00HEA0 rev.13.03G13 74,53GB
Running: z5th72jw.exe; Driver: C:\DOCUME~1\Wlodek\USTAWI~1\Temp\pxtdrpod.sys


---- System - GMER 2.0 ----

SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwClose [0xB768ACF0]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwCreateKey [0xB768ABAC]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwDeleteKey [0xB768B160]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwDeleteValueKey [0xB768B08A]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwDuplicateObject [0xB768A782]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwOpenKey [0xB768AC86]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwOpenProcess [0xB768A6C2]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwOpenThread [0xB768A726]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwQueryValueKey [0xB768ADA6]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwRenameKey [0xB768B22E]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwRestoreKey [0xB768AD66]
SSDT     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwSetValueKey [0xB768AEE6]

Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwCreateProcessEx [0xB7697BAE]
Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwCreateSection [0xB76979D2]
Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ZwLoadDriver [0xB7697B0C]
Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           NtCreateSection
Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ObInsertObject
Code     \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)                           ObMakeTemporaryObject

---- Kernel code sections - GMER 2.0 ----

PAGE     ntkrnlpa.exe!ZwLoadDriver                                                                                       8057832A 7 Bytes  JMP B7697B10 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE     ntkrnlpa.exe!NtCreateSection                                                                                    8059F23E 7 Bytes  JMP B76979D6 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE     ntkrnlpa.exe!ObMakeTemporaryObject                                                                              805B073A 5 Bytes  JMP B76935D4 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE     ntkrnlpa.exe!ObInsertObject                                                                                     805B7428 5 Bytes  JMP B7694FFA \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
PAGE     ntkrnlpa.exe!ZwCreateProcessEx                                                                                  805C5C32 7 Bytes  JMP B7697BB2 \SystemRoot\System32\Drivers\aswSP.SYS (avast! self protection module/AVAST Software)
.text    C:\WINDOWS\system32\DRIVERS\nv4_mini.sys                                                                        section is writeable [0xBA020360, 0x240F7E, 0xE8000020]

---- User code sections - GMER 2.0 ----

.text    C:\Program Files\Alwil Software\Avast5\AvastSvc.exe[2044] kernel32.dll!SetUnhandledExceptionFilter              7C810386 4 Bytes  [C2, 04, 00, 90] {RET 0x4; NOP }
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3916] ntdll.dll!LdrLoadDll                                         7C9161CA 5 Bytes  JMP 0150ED80 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3916] kernel32.dll!lstrlenW + 43                                   7C809A7C 7 Bytes  JMP 01855505 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3916] kernel32.dll!MapViewOfFileEx + 6A                            7C80B788 7 Bytes  JMP 018554E2 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3916] kernel32.dll!lstrcpyn + 70                                   7C810381 7 Bytes  JMP 015253B7 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)
.text    C:\Program Files\Mozilla Firefox\firefox.exe[3916] GDI32.dll!SetWindowOrgEx + 15E                               77F1960B 7 Bytes  JMP 01855463 C:\Program Files\Mozilla Firefox\xul.dll (Mozilla Foundation)

---- User IAT/EAT - GMER 2.0 ----

IAT      C:\WINDOWS\system32\services.exe[984] @ C:\WINDOWS\system32\services.exe [ADVAPI32.dll!CreateProcessAsUserW]    003C0002
IAT      C:\WINDOWS\system32\services.exe[984] @ C:\WINDOWS\system32\services.exe [KERNEL32.dll!CreateProcessW]          003C0000
---- Processes - GMER 2.0 ----

Library  C:\Documents (*** hidden *** ) @ C:\Documents [652]                                                             0x00400000                                                                                                            

---- Registry - GMER 2.0 ----

Reg      HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}\iexplore@Count  258

---- Disk sectors - GMER 2.0 ----

Disk     \Device\Harddisk0\DR0                                                                                           malicious Win32:MBRoot code @ sector 61
Disk     \Device\Harddisk0\DR0                                                                                           PE file @ sector 156280320

---- EOF - GMER 2.0 ----