GMER 1.0.15.15163 - http://www.gmer.net Rootkit scan 2009-10-19 03:37:06 Windows 6.0.6002 Service Pack 2 Running: 35r6qh1u.exe; Driver: C:\Users\TJCONN~1\AppData\Local\Temp\fxldypoc.sys ---- System - GMER 1.0.15 ---- INT 0x51 ? 86F7BBF8 INT 0x61 ? 857C8BF8 INT 0x61 ? 857C8BF8 INT 0x61 ? 857C8BF8 INT 0x61 ? 857C8BF8 INT 0x71 ? 86F7BBF8 INT 0x71 ? 86F7BBF8 INT 0x92 ? 86F7BBF8 INT 0xA2 ? 86F7BBF8 INT 0xB2 ? 86F7BBF8 ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 857CD1F8 Device \FileSystem\fastfat \FatCdrom 877BF1F8 Device \Driver\netbt \Device\NetBT_Tcpip_{AB455020-9033-415D-97B6-0F4A07DAFF25} 876BE500 AttachedDevice \Driver\kbdclass \Device\KeyboardClass0 VMkbd.sys Device \Driver\volmgr \Device\VolMgrControl 857CA1F8 Device \Driver\usbuhci \Device\USBPDO-0 86FD41F8 Device \Driver\usbuhci \Device\USBPDO-1 86FD41F8 Device \Driver\usbuhci \Device\USBPDO-2 86FD41F8 Device \Driver\usbehci \Device\USBPDO-3 86FE31F8 Device \Driver\usbuhci \Device\USBPDO-4 86FD41F8 AttachedDevice \Driver\tdx \Device\Tcp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\tdx \Device\Tcp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.) Device \Driver\usbuhci \Device\USBPDO-5 86FD41F8 Device \Driver\usbuhci \Device\USBPDO-6 86FD41F8 Device \Driver\volmgr \Device\HarddiskVolume1 857CA1F8 Device \Driver\usbehci \Device\USBPDO-7 86FE31F8 Device \Driver\volmgr \Device\HarddiskVolume2 857CA1F8 Device \Driver\cdrom \Device\CdRom0 86FDF1F8 Device \Driver\PCI_PNP0182 \Device\00000065 spca.sys Device \Driver\volmgr \Device\HarddiskVolume3 857CA1F8 Device \Driver\netbt \Device\NetBT_Tcpip_{E44325A2-F1B8-4BC6-9C92-080C18CC0BF7} 876BE500 Device \Driver\cdrom \Device\CdRom1 86FDF1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-0 857CC1F8 Device \Driver\atapi \Device\Ide\IdePort0 857CC1F8 Device \Driver\atapi \Device\Ide\IdePort1 857CC1F8 Device \Driver\atapi \Device\Ide\IdePort2 857CC1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-1 857CC1F8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T1L0-4 857CC1F8 Device \Driver\volmgr \Device\HarddiskVolume4 857CA1F8 Device \Driver\cdrom \Device\CdRom2 86FDF1F8 Device \Driver\USBSTOR \Device\00000080 86F4A1F8 Device \Driver\volmgr \Device\HarddiskVolume5 857CA1F8 Device \Driver\USBSTOR \Device\00000081 86F4A1F8 Device \Driver\volmgr \Device\HarddiskVolume6 857CA1F8 Device \Driver\USBSTOR \Device\00000082 86F4A1F8 Device \Driver\volmgr \Device\HarddiskVolume7 857CA1F8 Device \Driver\USBSTOR \Device\00000083 86F4A1F8 Device \Driver\netbt \Device\NetBt_Wins_Export 876BE500 Device \Driver\usbhub \Device\USBPDO-20 hcmon.sys Device \Driver\usbhub \Device\USBPDO-13 hcmon.sys Device \Driver\usbhub \Device\USBPDO-21 hcmon.sys Device \Driver\usbhub \Device\USBPDO-14 hcmon.sys Device \Driver\Smb \Device\NetbiosSmb 8773F500 Device \Driver\usbhub \Device\USBPDO-22 hcmon.sys Device \Driver\usbhub \Device\USBPDO-17 hcmon.sys Device \Driver\iScsiPrt \Device\RaidPort0 870EE1F8 AttachedDevice \Driver\tdx \Device\Udp aswTdi.SYS (avast! TDI Filter Driver/ALWIL Software) AttachedDevice \Driver\tdx \Device\Udp tmtdi.sys (Trend Micro TDI Driver (i386-fre)/Trend Micro Inc.) Device \Driver\usbhub \Device\USBPDO-18 hcmon.sys Device \Driver\usbhub \Device\USBPDO-19 hcmon.sys Device \Driver\usbuhci \Device\USBFDO-0 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-0 hcmon.sys Device \Driver\usbhub \Device\000000ab hcmon.sys Device \Driver\usbuhci \Device\USBFDO-1 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-1 hcmon.sys Device \Driver\usbhub \Device\000000ac hcmon.sys Device \Driver\sptd \Device\514950202 spca.sys Device \Driver\usbuhci \Device\USBFDO-2 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-2 hcmon.sys Device \Driver\usbhub \Device\0000007b hcmon.sys Device \Driver\usbhub \Device\0000006e hcmon.sys Device \Driver\usbehci \Device\USBFDO-3 86FE31F8 Device \Driver\usbehci \Device\USBFDO-3 hcmon.sys Device \Driver\usbhub \Device\0000006f hcmon.sys Device \Driver\usbuhci \Device\USBFDO-4 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-4 hcmon.sys Device \Driver\netbt \Device\NetBT_Tcpip_{D46ABC5E-F04E-419E-84D6-9AFB17AEA786} 876BE500 Device \Driver\USBSTOR \Device\0000007d 86F4A1F8 Device \Driver\usbuhci \Device\USBFDO-5 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-5 hcmon.sys Device \Driver\usbuhci \Device\USBFDO-6 86FD41F8 Device \Driver\usbuhci \Device\USBFDO-6 hcmon.sys Device \Driver\usbehci \Device\USBFDO-7 86FE31F8 Device \Driver\usbehci \Device\USBFDO-7 hcmon.sys Device \Driver\BTHUSB \Device\0000008c bthport.sys (Bluetooth Bus Driver/Microsoft Corporation) Device \Driver\af4eeefl \Device\Scsi\af4eeefl1 870E61F8 Device \Driver\af4eeefl \Device\Scsi\af4eeefl1Port4Path0Target0Lun0 870E61F8 Device \FileSystem\fastfat \Fat 877BF1F8 AttachedDevice \FileSystem\fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \FileSystem\cdfs \Cdfs 87B97500 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00197ee696a4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x57 0x95 0x83 0x1E ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAD 0x96 0xE6 0x27 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x04 0x10 0xEB ... Reg HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00197ee696a4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x57 0x95 0x83 0x1E ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0xAD 0x96 0xE6 0x27 ... Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet003\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0x64 0x04 0x10 0xEB ... ---- EOF - GMER 1.0.15 ----