TR/Agent.amd.2 in C:\Documents and Settings\All Users\Application Data\Avira\AntiVir Desktop\INFECTED

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-11-01 15:04:59
Windows 5.1.2600 Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3 FUJITSU_MHV2100AH rev.00000096
Running: p0gpw2v0.exe; Driver: C:\DOCUME~1\User\LOCALS~1\Temp\pwpcrfog.sys


---- System - GMER 1.0.15 ----

SSDT  F8C91394                                   ZwClose
SSDT  F8C9134E                                   ZwCreateKey
SSDT  F8C9139E                                   ZwCreateSection
SSDT  F8C91344                                   ZwCreateThread
SSDT  F8C91353                                   ZwDeleteKey
SSDT  F8C9135D                                   ZwDeleteValueKey
SSDT  F8C9138F                                   ZwDuplicateObject
SSDT  F8C91362                                   ZwLoadKey
SSDT  F8C91330                                   ZwOpenProcess
SSDT  F8C91335                                   ZwOpenThread
SSDT  F8C913B7                                   ZwQueryValueKey
SSDT  F8C9136C                                   ZwReplaceKey
SSDT  F8C913A8                                   ZwRequestWaitReplyPort
SSDT  F8C91367                                   ZwRestoreKey
SSDT  F8C913A3                                   ZwSetContextThread
SSDT  F8C913AD                                   ZwSetSecurityObject
SSDT  F8C91358                                   ZwSetValueKey
SSDT  F8C913B2                                   ZwSystemDebugControl
SSDT  F8C9133F                                   ZwTerminateProcess

---- Kernel code sections - GMER 1.0.15 ----

?     C:\DOCUME~1\User\LOCALS~1\Temp\aswMBR.sys  The system cannot find the file specified. !

---- EOF - GMER 1.0.15 ----
         

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-11-01 15:11:18
-----------------------------
15:11:18.218    OS Version: Windows 5.1.2600 Service Pack 3
15:11:18.218    Number of processors: 1 586 0xD08
15:11:18.218    ComputerName: USER-ABE2D26466  UserName: User
15:11:18.406    Initialize success
15:14:43.703    AVAST engine defs: 12110100
15:15:15.828    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-3
15:15:15.828    Disk 0 Vendor: FUJITSU_MHV2100AH 00000096 Size: 95396MB BusType: 3
15:15:15.937    Disk 0 MBR read successfully
15:15:15.937    Disk 0 MBR scan
15:15:18.281    Disk 0 Windows XP default MBR code
15:15:18.312    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS        15358 MB offset 63
15:15:19.734    Disk 0 Partition - 00     0F Extended LBA             80026 MB offset 31455270
15:15:19.812    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        80026 MB offset 31455333
15:15:19.906    Disk 0 scanning sectors +195350400
15:15:20.671    Disk 0 scanning C:\WINDOWS\system32\drivers
15:16:29.046    Service scanning
15:16:59.953    Modules scanning
15:17:19.796    Disk 0 trace - called modules:
15:17:20.296    ntkrnlpa.exe CLASSPNP.SYS disk.sys atapi.sys hal.dll intelide.sys PCIIDEX.SYS 
15:17:20.296    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x82573ab8]
15:17:20.296    3 CLASSPNP.SYS[f86c4fd7] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-3[0x82593d98]
15:17:21.328    AVAST engine scan C:\WINDOWS
15:17:42.578    AVAST engine scan C:\WINDOWS\system32
15:22:50.796    AVAST engine scan C:\WINDOWS\system32\drivers
15:23:17.484    AVAST engine scan C:\Documents and Settings\User
15:24:12.828    AVAST engine scan C:\Documents and Settings\All Users
15:24:32.390    Scan finished successfully
15:26:54.750    Disk 0 MBR has been saved successfully to "C:\Documents and Settings\User\My Documents\MBR.dat"
15:26:54.781    The log file has been saved successfully to "C:\Documents and Settings\User\My Documents\aswMBR.txt"