GMER 1.0.15.15273 - http://www.gmer.net Rootkit scan 2009-12-10 16:32:03 Windows 5.1.2600 Service Pack 2 Running: gmer.exe; Driver: C:\DOCUME~1\user\LOCALS~1\Temp\pwniyaow.sys ---- System - GMER 1.0.15 ---- SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwClose [0xA9998E36] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwCreateFile [0xA999CBD8] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwCreateKey [0xA999A098] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwCreateThread [0xA999E222] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDebugActiveProcess [0xA999DEF8] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDeleteFile [0xA999CF16] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDeleteKey [0xA999A2BE] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDeleteValueKey [0xA999A922] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDeviceIoControlFile [0xA9999042] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwDuplicateObject [0xA999C554] SSDT spcw.sys ZwEnumerateKey [0xF72C3CA4] SSDT spcw.sys ZwEnumerateValueKey [0xF72C4032] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwFsControlFile [0xA9998E78] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwInitiatePowerAction [0xA9998B9A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwLoadDriver [0xA999BF0C] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwMakeTemporaryObject [0xA9998CF8] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwOpenFile [0xA999CA10] SSDT spcw.sys ZwOpenKey [0xF72A50C0] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwOpenProcess [0xF78AF470] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwOpenSection [0xA999920C] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwOpenThread [0xA999E0BC] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwProtectVirtualMemory [0xA999E8F4] SSDT spcw.sys ZwQueryKey [0xF72C410A] SSDT spcw.sys ZwQueryValueKey [0xF72C3F8A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwReadVirtualMemory [0xA99993BC] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwRenameKey [0xA999A42E] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwReplaceKey [0xA999D848] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwRequestWaitReplyPort [0xA999C35E] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwRestoreKey [0xA999D69A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetContextThread [0xA999E690] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetInformationFile [0xA999D3CA] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetInformationProcess [0xA999DFE8] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetSystemInformation [0xA999C09C] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetSystemPowerState [0xA9998C4A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetSystemTime [0xA9998A3A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSetValueKey [0xA999A5E2] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwShutdownSystem [0xA9998B10] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSuspendProcess [0xA999DE0A] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSuspendThread [0xA999E56C] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwSystemDebugControl [0xA9998996] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwTerminateProcess [0xF78AF520] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwTerminateThread [0xF78AF5C0] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwWriteFile [0xA999D096] SSDT \??\c:\windows\system32\drivers\jaagabki.sys (Malware Defender Driver/TorchSoft) ZwWriteFileGather [0xA999D230] SSDT \??\C:\Program Files\AVG\AVG9\Identity Protection\Agent\Driver\Platform_XP\AVGIDSShim.sys (IDS Application Activity Monitor Loader Driver./AVG Technologies ) ZwWriteVirtualMemory [0xF78AF660] INT 0x63 ? 857D7BF8 INT 0x63 ? 857D7BF8 INT 0x63 ? 857D7BF8 INT 0x63 ? 857D7BF8 INT 0x63 ? 857D7BF8 INT 0x94 ? 854B8E58 INT 0xA4 ? 854B8E58 INT 0xB4 ? 854B8E58 INT 0xB4 ? 854B8E58 INT 0xB4 ? 854B8E58 INT 0xB4 ? 854B8E58 ---- Kernel code sections - GMER 1.0.15 ---- .text ntkrnlpa.exe!ZwCallbackReturn + 2DB8 80503C94 4 Bytes CALL 51B4E632 .text ntkrnlpa.exe!ZwCallbackReturn + 2F24 80503E00 4 Bytes CALL C2F9D7E4 .text ntkrnlpa.exe!ZwCallbackReturn + 2F54 80503E30 12 Bytes [9C, C0, 99, A9, 4A, 8C, 99, ...] .text ntkrnlpa.exe!ZwCallbackReturn + 2F88 80503E64 12 Bytes [0A, DE, 99, A9, 6C, E5, 99, ...] ? spcw.sys The system cannot find the file specified. ! .text USBPORT.SYS!DllUnload F6A4880C 5 Bytes JMP 854B8438 .text ad679rbh.SYS F68AF386 35 Bytes [00, 00, 00, 00, 00, 00, 20, ...] .text ad679rbh.SYS F68AF3AA 24 Bytes [00, 00, 00, 00, 00, 00, 00, ...] .text ad679rbh.SYS F68AF3C4 3 Bytes [00, 70, 02] {ADD [EAX+0x2], DH} .text ad679rbh.SYS F68AF3C9 1 Byte [30] .text ad679rbh.SYS F68AF3C9 11 Bytes [30, 00, 00, 00, 5C, 02, 00, ...] {XOR [EAX], AL; ADD [EAX], AL; POP ESP; ADD AL, [EAX]; ADD [EAX], AL; ADD [EAX], AL} .text ... pnidata C:\WINDOWS\system32\DRIVERS\secdrv.sys unknown last section [0xA8AA1F00, 0x24000, 0x48000000] ---- Kernel IAT/EAT - GMER 1.0.15 ---- IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [F72A6042] spcw.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [F72A613E] spcw.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [F72A60C0] spcw.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [F72A6800] spcw.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [F72A66D6] spcw.sys IAT \SystemRoot\system32\DRIVERS\i8042prt.sys[HAL.dll!READ_PORT_UCHAR] [F72B5E9C] spcw.sys IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KfAcquireSpinLock] 0C8D1C46 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!READ_PORT_UCHAR] B08B8932 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KeGetCurrentIrql] 89000001 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KfRaiseIrql] 0001BC83 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KfLowerIrql] 24468B00 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!HalGetInterruptVector] 89820C8D IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!HalTranslateBusAddress] D18BF84D IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KeStallExecutionProcessor] 860F1639 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!KfReleaseSpinLock] 000000BD IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!READ_PORT_BUFFER_USHORT] 0208B389 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!READ_PORT_USHORT] 83660000 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!WRITE_PORT_BUFFER_USHORT] 7400067E IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[HAL.dll!WRITE_PORT_UCHAR] 89D60320 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[WMILIB.SYS!WmiSystemControl] 8D168B00 IAT \SystemRoot\System32\Drivers\ad679rbh.SYS[WMILIB.SYS!WmiCompleteRequest] F0003284 ---- Devices - GMER 1.0.15 ---- Device \FileSystem\Ntfs \Ntfs 857D61F8 AttachedDevice \FileSystem\Ntfs \Ntfs AVGIDSFilter.sys (IDS Application Activity Monitor Filter Driver./AVG Technologies ) AttachedDevice \Driver\Tcpip \Device\Ip avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\Ip jaagabki.sys (Malware Defender Driver/TorchSoft) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass0 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) AttachedDevice \Driver\Kbdclass \Device\KeyboardClass1 SynTP.sys (Synaptics Touchpad Driver/Synaptics, Inc.) Device \Driver\PCI_PNP5662 \Device\00000050 spcw.sys Device \Driver\usbuhci \Device\USBPDO-0 854B71F8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 857661F8 Device \Driver\dmio \Device\DmControl\DmConfig 857661F8 Device \Driver\dmio \Device\DmControl\DmPnP 857661F8 Device \Driver\dmio \Device\DmControl\DmInfo 857661F8 Device \Driver\usbuhci \Device\USBPDO-1 854B71F8 Device \Driver\usbehci \Device\USBPDO-2 8554C1F8 Device \Driver\usbehci \Device\USBPDO-3 8554C1F8 Device \Driver\usbuhci \Device\USBPDO-4 854B71F8 AttachedDevice \Driver\Tcpip \Device\Tcp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\Tcp jaagabki.sys (Malware Defender Driver/TorchSoft) Device \Driver\usbuhci \Device\USBPDO-5 854B71F8 Device \Driver\usbuhci \Device\USBPDO-6 854B71F8 Device \Driver\Ftdisk \Device\HarddiskVolume1 857D81F8 Device \Driver\usbuhci \Device\USBPDO-7 854B71F8 Device \Driver\Cdrom \Device\CdRom0 854E41F8 Device \Driver\Ftdisk \Device\HarddiskVolume2 857D81F8 Device \Driver\Cdrom \Device\CdRom1 854E41F8 Device \Driver\atapi \Device\Ide\IdePort0 857D71F8 Device \Driver\atapi \Device\Ide\IdeDeviceP0T0L0-3 857D71F8 Device \Driver\atapi \Device\Ide\IdePort1 857D71F8 Device \Driver\atapi \Device\Ide\IdePort2 857D71F8 Device \Driver\atapi \Device\Ide\IdePort3 857D71F8 Device \Driver\atapi \Device\Ide\IdeDeviceP1T0L0-e 857D71F8 Device \Driver\NetBT \Device\NetBt_Wins_Export 8548A500 Device \Driver\NetBT \Device\NetbiosSmb 8548A500 Device \Driver\NetBT \Device\NetBT_Tcpip_{F59E2742-F9BF-44F2-9066-DB87B969B2AF} 8548A500 AttachedDevice \Driver\Tcpip \Device\Udp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\Udp jaagabki.sys (Malware Defender Driver/TorchSoft) AttachedDevice \Driver\Tcpip \Device\RawIp avgtdix.sys (AVG Network connection watcher/AVG Technologies CZ, s.r.o.) AttachedDevice \Driver\Tcpip \Device\RawIp jaagabki.sys (Malware Defender Driver/TorchSoft) Device \Driver\NetBT \Device\NetBT_Tcpip_{DBB7F53E-A054-4BD8-8A4A-510054F4E22A} 8548A500 Device \Driver\usbuhci \Device\USBFDO-0 854B71F8 Device \Driver\usbuhci \Device\USBFDO-1 854B71F8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 84F27500 Device \Driver\usbehci \Device\USBFDO-2 8554C1F8 Device \FileSystem\MRxSmb \Device\LanmanRedirector 84F27500 Device \Driver\usbuhci \Device\USBFDO-3 854B71F8 Device \Driver\sptd \Device\1381568162 spcw.sys Device \Driver\usbuhci \Device\USBFDO-4 854B71F8 Device \Driver\Ftdisk \Device\FtControl 857D81F8 Device \Driver\usbuhci \Device\USBFDO-5 854B71F8 Device \Driver\usbuhci \Device\USBFDO-6 854B71F8 Device \Driver\usbehci \Device\USBFDO-7 8554C1F8 Device \Driver\ad679rbh \Device\Scsi\ad679rbh1 853A81F8 Device \Driver\ad679rbh \Device\Scsi\ad679rbh1Port4Path0Target0Lun0 853A81F8 Device \FileSystem\Cdfs \Cdfs 853F3500 ---- Registry - GMER 1.0.15 ---- Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 771343423 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 285507792 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE0 0xBD 0xF2 0x04 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBD 0x7A 0x4B 0xA1 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x7D 0xF7 0xAF 0xAA ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@p0 C:\Program Files\DAEMON Tools Lite\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC@hdf12 0xE0 0xBD 0xF2 0x04 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001@hdf12 0xBD 0x7A 0x4B 0xA1 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0 (not active ControlSet) Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\14919EA49A8F3B4AA3CF1058D9A64CEC\00000001\gdq0@hdf12 0x7D 0xF7 0xAF 0xAA ... ---- Files - GMER 1.0.15 ---- File C:\WINDOWS\Temp\fa5d1f06-fc8b-4523-8315-3c5f5d9edb15.tmp 0 bytes ---- EOF - GMER 1.0.15 ----