GMER 1.0.15.15641 - http://www.gmer.net Rootkit scan 2012-03-28 11:23:06 Windows 5.1.2600 Dodatek Service Pack 3 Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-0 TOSHIBA_ rev.LB01 Running: o9hxr56p.exe; Driver: C:\DOCUME~1\Piotr\USTAWI~1\Temp\kgdyqpoc.sys ---- System - GMER 1.0.15 ---- SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwAllocateVirtualMemory [0x9E2266E0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwAssignProcessToJobObject [0x9E226610] SSDT BA6C69AC ZwClose SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwConnectPort [0x9E226980] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateFile [0x9E2241B0] SSDT BA6C6966 ZwCreateKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcess [0x9E225AB0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateProcessEx [0x9E225BA0] SSDT BA6C69B6 ZwCreateSection SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwCreateSymbolicLinkObject [0x9E224AB0] SSDT BA6C695C ZwCreateThread SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwDebugActiveProcess [0x9E226FB0] SSDT BA6C696B ZwDeleteKey SSDT BA6C6975 ZwDeleteValueKey SSDT BA6C69A7 ZwDuplicateObject SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwEnumerateKey [0x9E224E10] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwEnumerateValueKey [0x9E224EF0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwFsControlFile [0x9E2240C0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwLoadDriver [0x9E229000] SSDT BA6C697A ZwLoadKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwMakeTemporaryObject [0x9E2249F0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenFile [0x9E224640] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenKey [0x9E224C80] SSDT BA6C6948 ZwOpenProcess SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwOpenSection [0x9E223EB0] SSDT BA6C694D ZwOpenThread SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwProtectVirtualMemory [0x9E2268A0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueryKey [0x9E224FD0] SSDT BA6C69CF ZwQueryValueKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwQueueApcThread [0x9E226540] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRenameKey [0x9E2255B0] SSDT BA6C6984 ZwReplaceKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwRequestPort [0x9E226C50] SSDT BA6C69C0 ZwRequestWaitReplyPort SSDT BA6C697F ZwRestoreKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKey [0x9E225340] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSaveKeyEx [0x9E225410] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSecureConnectPort [0x9E226A70] SSDT BA6C69BB ZwSetContextThread SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetInformationDebugObject [0x9E227080] SSDT BA6C69C5 ZwSetSecurityObject SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSetSystemInformation [0x9E225760] SSDT BA6C6970 ZwSetValueKey SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendProcess [0x9E2262A0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwSuspendThread [0x9E226360] SSDT BA6C69CA ZwSystemDebugControl SSDT BA6C6957 ZwTerminateProcess SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwTerminateThread [0x9E226150] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwUnloadDriver [0x9E225830] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwWriteFile [0x9E223FB0] SSDT \??\C:\WINDOWS\system32\drivers\SandBox.sys (Host Protection Component/Agnitum Ltd.) ZwWriteVirtualMemory [0x9E2267C0] ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2FD8 80504874 12 Bytes [A0, 62, 22, 9E, 60, 63, 22, ...] ---- User code sections - GMER 1.0.15 ---- .text C:\WINDOWS\system32\svchost.exe[256] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[256] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[256] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[256] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[556] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[556] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[556] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[556] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\wscntfy.exe[672] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\wscntfy.exe[672] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\wscntfy.exe[672] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\wscntfy.exe[672] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\Documents and Settings\Piotr\Pulpit\o9hxr56p.exe[724] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\Documents and Settings\Piotr\Pulpit\o9hxr56p.exe[724] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\Documents and Settings\Piotr\Pulpit\o9hxr56p.exe[724] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\Documents and Settings\Piotr\Pulpit\o9hxr56p.exe[724] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[752] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[752] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[752] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[752] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\Program Files\PeerBlock\peerblock.exe[1116] kernel32.dll!SetUnhandledExceptionFilter 7C84495D 5 Bytes JMP 004314E0 C:\Program Files\PeerBlock\peerblock.exe (PeerBlock/PeerBlock, LLC) .text C:\WINDOWS\system32\svchost.exe[1644] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[1644] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[1644] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\system32\svchost.exe[1644] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\System32\alg.exe[2688] USER32.dll!ChangeDisplaySettingsExA 7E37384E 5 Bytes JMP 100A55F8 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\System32\alg.exe[2688] USER32.dll!SetForegroundWindow 7E3742ED 5 Bytes JMP 100A5574 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\System32\alg.exe[2688] USER32.dll!SetWindowPos 7E3799F3 5 Bytes JMP 100A55A0 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) .text C:\WINDOWS\System32\alg.exe[2688] USER32.dll!ChangeDisplaySettingsExW 7E3A95BD 5 Bytes JMP 100A5624 c:\PROGRA~1\OUTPOS~1\wl_hook.dll (Outpost Hooking Module/Agnitum Ltd.) ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT \SystemRoot\system32\DRIVERS\ndiswan.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\raspppoe.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\psched.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\System32\Drivers\NDProxy.SYS[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\tcpip.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\wanarp.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\arp1394.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) IAT \SystemRoot\system32\DRIVERS\ndisuio.sys[NDIS.SYS!NdisOpenAdapter] [B7E90182] \SystemRoot\system32\drivers\afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) ---- Devices - GMER 1.0.15 ---- Device \Driver\Tcpip \Device\Ip afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\Tcp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\Udp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\RawIp afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) Device \Driver\Tcpip \Device\IPMULTICAST afwcore.sys (Agnitum Firewall Core Driver/Agnitum Ltd.) ---- Processes - GMER 1.0.15 ---- Library c:\windows\system32\ql2100.dll (*** hidden *** ) @ C:\WINDOWS\System32\svchost.exe [296] 0x3AFD0000 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@u0 0x00 0x00 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0x13 0x33 0x0F 0xFA ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xE6 0xD6 0x44 0xCF ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0xCF 0x59 0xCC 0x3F ... Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesProcessed 34 Reg HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher@TracesSuccessful 24 ---- EOF - GMER 1.0.15 ----