GMER 1.0.15.15281 - http://www.gmer.net Rootkit scan 2010-09-20 18:50:08 Windows 6.1.7600 Running: u4dztu0i.exe; Driver: C:\Users\lukas\AppData\Local\Temp\kwdyqkog.sys ---- System - GMER 1.0.15 ---- INT 0x1F \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82829AF8 INT 0x37 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82829104 INT 0xC1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828293F4 INT 0xD1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828122D8 INT 0xD2 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82811898 INT 0xDF \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828291DC INT 0xE1 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82829958 INT 0xE3 \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 828296F8 INT 0xFD \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 82829F2C INT 0xFE \SystemRoot\system32\halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) 8282A1A8 ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwSaveKeyEx + 13AD 82889579 1 Byte [06] .text ntkrnlpa.exe!KiDispatchInterrupt + 5A2 828ADF52 19 Bytes [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3} .text peauth.sys 94A1DC9D 28 Bytes [0F, 22, 1A, 2A, 5F, BC, DD, ...] .text peauth.sys 94A1DCC1 28 Bytes [0F, 22, 1A, 2A, 5F, BC, DD, ...] PAGE spsys.sys!?SPRevision@@3PADA + 4F90 94BA4000 98 Bytes [8B, FF, 55, 8B, EC, 33, C0, ...] PAGE spsys.sys!?SPRevision@@3PADA + 4FF3 94BA4063 49 Bytes [94, 8B, 45, 08, F0, 0F, BA, ...] PAGE spsys.sys!?SPRevision@@3PADA + 5025 94BA4095 141 Bytes JMP 828825D0 \SystemRoot\system32\ntkrnlpa.exe (NT Kernel & System/Microsoft Corporation) PAGE spsys.sys!?SPRevision@@3PADA + 50B3 94BA4123 629 Bytes [F5, B9, 94, FE, 05, 34, F5, ...] PAGE spsys.sys!?SPRevision@@3PADA + 5329 94BA4399 101 Bytes [6A, 28, 59, A5, 5E, C6, 03, ...] PAGE ... ---- User IAT/EAT - GMER 1.0.15 ---- IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\ADVAPI32.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\GDI32.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) IAT C:\Program Files\Mozilla Firefox\firefox.exe[3280] @ C:\Windows\system32\Secur32.dll [KERNEL32.dll!GetProcAddress] [752D5D3D] C:\Windows\system32\apphelp.dll (Biblioteka klienta zgodności aplikacji/Microsoft Corporation) ---- Devices - GMER 1.0.15 ---- Device \Driver\ACPI_HAL \Device\00000044 halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume1 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume2 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation) AttachedDevice \Driver\volmgr \Device\HarddiskVolume3 rdyboost.sys (ReadyBoost Driver/Microsoft Corporation) ---- Disk sectors - GMER 1.0.15 ---- Disk \Device\Harddisk0\DR0 sector 61: copy of MBR Disk \Device\Harddisk0\DR0 sector 62: copy of MBR ---- EOF - GMER 1.0.15 ----