GMER 1.0.15.15281 - http://www.gmer.net
Rootkit scan 2010-03-08 13:08:51
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\pgkiqkow.sys


---- System - GMER 1.0.15 ----

SSDT            821670D8                                                                                    ZwAlertResumeThread
SSDT            821681F8                                                                                    ZwAlertThread
SSDT            82204E48                                                                                    ZwAllocateVirtualMemory
SSDT            822E6B40                                                                                    ZwAssignProcessToJobObject
SSDT            820601B0                                                                                    ZwConnectPort
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwCreateKey [0xEFD4D210]
SSDT            820F1628                                                                                    ZwCreateMutant
SSDT            8211CCB0                                                                                    ZwCreateSymbolicLinkObject
SSDT            82224D78                                                                                    ZwCreateThread
SSDT            821981E8                                                                                    ZwDebugActiveProcess
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteKey [0xEFD4D490]
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwDeleteValueKey [0xEFD4D9F0]
SSDT            82226D68                                                                                    ZwDuplicateObject
SSDT            820B31A8                                                                                    ZwFreeVirtualMemory
SSDT            821535A8                                                                                    ZwImpersonateAnonymousToken
SSDT            821633F0                                                                                    ZwImpersonateThread
SSDT            82155740                                                                                    ZwLoadDriver
SSDT            82211318                                                                                    ZwMapViewOfSection
SSDT            82153110                                                                                    ZwOpenEvent
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwOpenKey [0xEFD4D7A0]
SSDT            822B4BE8                                                                                    ZwOpenProcess
SSDT            82179368                                                                                    ZwOpenProcessToken
SSDT            821DDE30                                                                                    ZwOpenSection
SSDT            822BAAD0                                                                                    ZwOpenThread
SSDT            8211CDA0                                                                                    ZwProtectVirtualMemory
SSDT            8216A2C0                                                                                    ZwResumeThread
SSDT            82174630                                                                                    ZwSetContextThread
SSDT            820E9FC0                                                                                    ZwSetInformationProcess
SSDT            821D58B8                                                                                    ZwSetSystemInformation
SSDT            \??\C:\WINDOWS\system32\Drivers\SYMEVENT.SYS (Symantec Event Library/Symantec Corporation)  ZwSetValueKey [0xEFD4DC40]
SSDT            81C1A090                                                                                    ZwSuspendProcess
SSDT            8216AB18                                                                                    ZwSuspendThread
SSDT            82179A80                                                                                    ZwTerminateProcess
SSDT            82173248                                                                                    ZwTerminateThread
SSDT            82179290                                                                                    ZwUnmapViewOfSection
SSDT            821C3440                                                                                    ZwWriteVirtualMemory

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\Tcpip \Device\Ip                                                                    SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Tcp                                                                   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\Udp                                                                   SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \Driver\Tcpip \Device\RawIp                                                                 SYMTDI.SYS (Network Dispatch Driver/Symantec Corporation)
AttachedDevice  \FileSystem\Fastfat \Fat                                                                    fltMgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----