GMER 1.0.15.15641 - http://www.gmer.net
Rootkit scan 2012-04-25 11:51:50
Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 FUJITSU_ rev.8919
Running: ceqfl3vo.exe; Driver: C:\DOCUME~1\Andrzej\USTAWI~1\Temp\fxdcrpoc.sys


---- System - GMER 1.0.15 ----

SSDT            89B651A8                                                                                       ZwAlertResumeThread
SSDT            89AF7200                                                                                       ZwAlertThread
SSDT            86E8DEA8                                                                                       ZwAllocateVirtualMemory
SSDT            89B754E8                                                                                       ZwConnectPort
SSDT            8A5D07E0                                                                                       ZwCreateMutant
SSDT            86D721F8                                                                                       ZwCreateThread
SSDT            89BE1340                                                                                       ZwFreeVirtualMemory
SSDT            89AF6538                                                                                       ZwImpersonateAnonymousToken
SSDT            89AF6A08                                                                                       ZwImpersonateThread
SSDT            89BE3008                                                                                       ZwMapViewOfSection
SSDT            86E8E680                                                                                       ZwOpenEvent
SSDT            89B8B558                                                                                       ZwOpenProcessToken
SSDT            89B70080                                                                                       ZwOpenThreadToken
SSDT            \??\C:\WINDOWS\system32\drivers\wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)  ZwProtectVirtualMemory [0xF755C880]
SSDT            89ADD740                                                                                       ZwResumeThread
SSDT            89ADC1A8                                                                                       ZwSetContextThread
SSDT            89BE1C70                                                                                       ZwSetInformationProcess
SSDT            89B720C0                                                                                       ZwSetInformationThread
SSDT            89B0F5E0                                                                                       ZwSuspendProcess
SSDT            89B661A8                                                                                       ZwSuspendThread
SSDT            89AF8DA8                                                                                       ZwTerminateProcess
SSDT            89B94560                                                                                       ZwTerminateThread
SSDT            89BD6C20                                                                                       ZwUnmapViewOfSection
SSDT            86F6E4A0                                                                                       ZwWriteVirtualMemory

---- Kernel code sections - GMER 1.0.15 ----

.text           ntkrnlpa.exe!ZwCallbackReturn + 2C60                                                           805044FC 4 Bytes  [E8, 54, B7, 89]

---- User code sections - GMER 1.0.15 ----

.text           C:\WINDOWS\system32\SearchIndexer.exe[516] kernel32.dll!WriteFile                              7C810E27 7 Bytes  JMP 00585C0C C:\WINDOWS\system32\MSSRCH.DLL (mssrch.dll/Microsoft Corporation)

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                       wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Ip                                                                       SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Kbdclass \Device\KeyboardClass0                                                        Wdf01000.sys (Kernel Mode Driver Framework Runtime/Microsoft Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                      wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                      SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                      wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                      SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                    wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)

Device          \Driver\SYMTDI \Device\SymTDI                                                                  wpsdrvnt.sys (Symantec CMC Firewall WPS/Symantec Corporation)

AttachedDevice  \FileSystem\Fastfat \Fat                                                                       fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----