GMER 1.0.15.15227 - http://www.gmer.net
Rootkit scan 2009-11-17 09:33:52
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: C:\DOCUME~1\EHRICH~1\LOCALS~1\Temp\pxtoapoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.rsrc           C:\WINDOWS\system32\drivers\atapi.sys               entry point in ".rsrc" section [0xF8411780]

---- Devices - GMER 1.0.15 ----

Device          \Driver\atapi \Device\Ide\IdeDeviceP1T1L0-17        [F8404B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device          \Driver\atapi \Device\Ide\IdePort0                  [F8404B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device          \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3         [F8404B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device          \Driver\atapi \Device\Ide\IdePort1                  [F8404B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device          \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-f         [F8404B3A] atapi.sys[unknown section] {MOV EAX, [0xffdf0308]; JMP [EAX+0xfc]}
Device                                                              mrxsmb.sys (Windows NT SMB Minirdr/Microsoft Corporation)
Device                                                              Fastfat.SYS (Fast FAT File System Driver/Microsoft Corporation)

AttachedDevice                                                      fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation)

Device          \FileSystem\Fs_Rec \FileSystem\UdfsCdRomRecognizer  tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device          \FileSystem\Fs_Rec \FileSystem\FatCdRomRecognizer   tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device          \FileSystem\Fs_Rec \FileSystem\CdfsRecognizer       tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device          \FileSystem\Fs_Rec \FileSystem\FatDiskRecognizer    tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)
Device          \FileSystem\Fs_Rec \FileSystem\UdfsDiskRecognizer   tfsnifs.sys (Drive Letter Access Component/Sonic Solutions)

---- Files - GMER 1.0.15 ----

File            C:\WINDOWS\system32\drivers\atapi.sys               suspicious modification

---- EOF - GMER 1.0.15 ----