GMER 1.0.14.14536 - http://www.gmer.net Rootkit scan 2009-02-25 11:30:24 Windows 5.0.2195 Service Pack 4 ---- User code sections - GMER 1.0.14 ---- .text C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1108] USER32.dll!VRipOutput + FFFB8783 77E13A00 4 Bytes [ 70, 11, 41, 6D ] .text C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1448] USER32.dll!VRipOutput + FFFB8783 77E13A00 4 Bytes [ 70, 11, 41, 6D ] ---- Kernel code sections - GMER 1.0.14 ---- .text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 BFAFA4D0 16 Bytes [ CB, 54, EB, C5, C6, C9, 9E, ... ] .text dtscsi.sys!A0DB34FC6FE35D429A28ADDE5467D4D7 + 11 BFAFA4E1 31 Bytes [ 90, AF, BF, A3, 13, 19, 35, ... ] ---- User code sections - GMER 1.0.14 ---- ? C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1108] C:\WINNT\system32\KERNEL32.dll time/date stamp mismatch; ? C:\Programmi\Kaspersky Lab\Kaspersky Anti-Virus 2009\avp.exe[1448] C:\WINNT\system32\KERNEL32.dll time/date stamp mismatch; ---- Kernel code sections - GMER 1.0.14 ---- ? C:\WINNT\System32\Drivers\dtscsi.sys Impossibile accedere al file. Il file � utilizzato da un altro processo. ? C:\WINNT\system32\drivers\sptd.sys Impossibile accedere al file. Il file � utilizzato da un altro processo. ? C:\WINNT\System32\Drivers\SPTD5581.SYS Impossibile accedere al file. Il file � utilizzato da un altro processo. ---- Devices - GMER 1.0.14 ---- AttachedDevice \FileSystem\Fastfat \Fat fltmgr.sys (Microsoft Filesystem Filter Manager/Microsoft Corporation) Device \Driver\00000103 \Device\00000007 sptd.sys Device \Driver\Cdrom \Device\CdRom0 81FAF7A8 Device \Driver\Cdrom \Device\CdRom1 81FAF7A8 Device \Driver\Cdrom \Device\CdRom2 81FAF7A8 Device \Driver\Disk \Device\Harddisk0\DR0 820BC1C8 Device \Driver\Disk \Device\Harddisk1\DR1 820BC1C8 Device \Driver\dmio \Device\DmControl\DmConfig 820BC6C8 Device \Driver\dmio \Device\DmControl\DmInfo 820BC6C8 Device \Driver\dmio \Device\DmControl\DmIoDaemon 820BC6C8 Device \Driver\dmio \Device\DmControl\DmPnP 820BC6C8 Device \Driver\dtscsi \Device\Scsi\dtscsi1 81F86DC8 Device \Driver\dtscsi \Device\Scsi\dtscsi1Port2Path0Target0Lun0 81F86DC8 Device \Driver\Ftdisk \Device\FtControl 820BC908 Device \Driver\Ftdisk \Device\HarddiskVolume1 820BC908 Device \Driver\Ftdisk \Device\HarddiskVolume2 820BC908 Device \Driver\NetBT \Device\NetbiosSmb 81D839A8 Device \Driver\NetBT \Device\NetBT_Tcpip_{E5E72B87-5298-4953-BD78-BAD92DCB4C6F} 81D839A8 Device \Driver\NetBT \Device\NetBt_Wins_Export 81D839A8 Device \FileSystem\Cdfs \Cdfs 81A35848 Device \FileSystem\Fastfat \Fat 81A29CA8 Device \FileSystem\MRxSmb \Device\LanmanDatagramReceiver 81E9FC88 Device \FileSystem\MRxSmb \Device\LanmanRedirector 81E9FC88 Device \FileSystem\Msfs \Device\Mailslot 81EE4D88 Device \FileSystem\Npfs \Device\NamedPipe 81DA8E48 Device \FileSystem\Ntfs \Ntfs 82086EA8 Device \FileSystem\Rdbss \Device\FsWrap 81E96B28 ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT \SystemRoot\System32\DRIVERS\cdrom.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [BFF5479E] sptd.sys IAT \SystemRoot\System32\DRIVERS\i8042prt.sys[HAL.DLL!READ_PORT_UCHAR] [BFF53BBC] sptd.sys IAT \SystemRoot\System32\DRIVERS\mrxsmb.sys[ntoskrnl.exe!IofCallDriver] [BFF30020] sptd.sys IAT \SystemRoot\System32\DRIVERS\rdbss.sys[ntoskrnl.exe!IofCallDriver] [BFF30020] sptd.sys IAT \WINNT\System32\DRIVERS\CLASSPNP.SYS[ntoskrnl.exe!IoDetachDevice] [BFF431BA] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_BUFFER_USHORT] [BFF30B6E] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_UCHAR] [BFF30A32] sptd.sys IAT atapi.sys[HAL.dll!READ_PORT_USHORT] [BFF30AF6] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_BUFFER_USHORT] [BFF316CC] sptd.sys IAT atapi.sys[HAL.dll!WRITE_PORT_UCHAR] [BFF315A2] sptd.sys IAT atapi.sys[ntoskrnl.exe!IoConnectInterrupt] [BFF3DFA6] sptd.sys IAT atapi.sys[ntoskrnl.exe!IofCompleteRequest] [BFF53BB0] sptd.sys ---- User IAT/EAT - GMER 1.0.14 ---- IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\ADVAPI32.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\GDI32.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\iphlpapi.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\ole32.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\Secur32.dll [KERNEL32.DLL!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\USER32.DLL [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\Programmi\Mozilla Thunderbird\thunderbird.exe[1316] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA] [02037376] C:\Programmi\Mozilla Thunderbird\extensions\[removed]\components\FULLSOFT.DLL (Talkback Library/Full Circle Software, Inc.) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\Explorer.EXE [KERNEL32.DLL!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\ADVAPI32.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExA] [778978DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\CRYPT32.dll [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\GDI32.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\NETAPI32.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\OLE32.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.DLL!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.DLL!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\PSAPI.DLL [KERNEL32.DLL!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\RPCRT4.dll [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\Secur32.dll [KERNEL32.DLL!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\Secur32.dll [KERNEL32.DLL!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\Secur32.dll [KERNEL32.DLL!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\Secur32.dll [KERNEL32.DLL!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHELL32.dll [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessA] [23021346] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExA] [778978DE] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\SHLWAPI.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USER32.dll [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!CreateProcessW] [230214FD] C:\WINNT\AppPatch\AcLayers.DLL (Windows 2000 Shim Accessory DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryExW] [77897955] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\USERENV.DLL [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WININET.dll [KERNEL32.dll!LoadLibraryW] [7789786F] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2_32.DLL [KERNEL32.DLL!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!FreeLibrary] [77897A04] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!GetProcAddress] [7789771E] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) IAT C:\WINNT\Explorer.EXE[1056] @ C:\WINNT\system32\WS2HELP.DLL [KERNEL32.DLL!LoadLibraryA] [77897800] C:\WINNT\system32\shim.dll (Shim Engine DLL/Microsoft Corporation) ---- Kernel IAT/EAT - GMER 1.0.14 ---- IAT disk.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [BFF5479E] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IofCallDriver] [BFF3E620] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IoGetAttachedDeviceReference] [BFF3E550] sptd.sys IAT ftdisk.sys[ntoskrnl.exe!IoGetDeviceObjectPointer] [BFF3E454] sptd.sys IAT PartMgr.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [BFF53F6C] sptd.sys IAT PartMgr.sys[ntoskrnl.exe!IoDetachDevice] [BFF3E10E] sptd.sys IAT pci.sys[ntoskrnl.exe!IoAttachDeviceToDeviceStack] [BFF54658] sptd.sys IAT pci.sys[ntoskrnl.exe!IoDetachDevice] [BFF3DF52] sptd.sys ---- Registry - GMER 1.0.14 ---- Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG10.00.00.01WORKSTATION E97A55E4D2F53F29ACDF51D0358BB99892AB3AFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2F6E667A6171C11EC38DE3D5D575E7D6A3B98088EDD5E5BE2F6E66748C29376B5BF93AD996DA3D540B7B7A28C30BDAAF90702B2653C632D81E95BBE89A38A8C28E26D44ADE76214F7938F033F9EEFE0912B06BEB5A4F5A9D85B15901B5D2A1772E76140F70BC1260F419EB5842BC8220928117AAEED492ACEF0DDBFEEB3C2C4A1C7AD85E924780DA18F9844E94D82E128C76A2C1C5ABB31F80C3375ADCFF74C381AA43E29640DCEBDF045F5AFE02A96ABF470DFFA8D81475F31261FB140C164AC1E2C578DE45D74E6FB7FD9CC2321BA42BF90E2FE91A0F8808ADB6A8A76EBCBE6B4BF82A11E1A8C936D3642EB391E4C12DB52CA8C50F4D4CCE20D4E7D471742C8646C34A86FC8293022EC4668AAAACF31224B6CC09C2B6EA8AC8701FEEBB48BA0D7D426959A405E9A1EBCBE53E1A4492C8CA7E5E928C6DDEDFBAC7EBE028FF0B6DA2ED49246AE47A5874D4AF4AFBD4603BCA992880EA03E698AF187180BC03F44604502F8FC9400992AE04AC346FAD32A752498D4C861AFDB34E0A1216C39C7767F76B25DAD47ABB073C966EFBC38838920015E383A08D6FAFA9592A0703DDD71EF34300129EE6E19F7EE875A10A0ED7CC6BA0ED2266759E Reg HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\System@OODEFRAG11.00.00.01WORKSTATION EDCF803DF2C1AF95C7E8FE3C80FC30E2DC07148B2F37609DFAA42AF7FBBF71E5ADD561F583661C956A3C48044D773B651605DE1B03B8BF29CD73E838FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A6A0AC4980AC79335D575E7D6A3B9808A9C6AECB7A5D1407B0B14DB991E48DCB30998C87BD00B565D28D1826A18E87FBD27CD4EA37A2C100E4329235EFBFDB87E064FA2981EAD74E39C7CE7784486DC7C3336E396C49FAC6D6DB3C5C3FEC462AA614C41C2B0B19A10B2ABC0AE7B61E837E47CB2B62A71CA67A6DADA34240745E1EF81AEC37157A77AA3501A3198D194DC60A99605D93C4E81A2CC0A352D1C0B6B5659F4E308035C7CA6E2C2FFA4792A7B4CFF51AB5A6C4B653DA3F965B7B39A4AD33EE13380B34EFF15FC6390320F2F837F37341D23FA2A198C76BDCDCDBA104A0BC153684B297B27D13C8F5BC9AD78B8C521ADE38FE171BAE3FF6FAECD86E0EF66192525E3CB1331D1B203844F9110E4B4E6423774D11FCAF148C1932964D65EF055DAAA3300BFB548BB07CCDC8A3925ACBC060B6D2B1010B1E45026982998D1E905DA2C4DBDFF9F97D4FDE1F54C611F836148CB27E4DC600B7B227E2C8E76FE8EC70C3C74D1E003C0D45A2922DE9E036FAB344BA836E51A43E591A83607D568A0D66BA45D9E9C118DB522 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x00 0xB8 0xBA 0x8A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\ Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0D 0xA9 0x18 0x6A ... Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE8 0x36 0xC7 0x94 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@h0 1 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s0 -908452862 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s1 57980983 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg@s2 1515332112 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@h0 0 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@khjeh 0x00 0xB8 0xBA 0x8A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4@p0 C:\Programmi\DAEMON Tools\ Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@a0 0x20 0x01 0x00 0x00 ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001@khjeh 0x0D 0xA9 0x18 0x6A ... Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40 Reg HKLM\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40@khjeh 0xE8 0x36 0xC7 0x94 ... ---- System - GMER 1.0.14 ---- SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwAdjustPrivilegesToken [0xBE8F7384] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwClose [0xBE8F795E] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwConnectPort [0xBE8F9376] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwCreateFile [0xBE8F8D28] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwCreateKey [0xBE8F6AFA] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwCreateSymbolicLinkObject [0xBE8FAD08] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwCreateThread [0xBE8F7758] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwDeleteKey [0xBE8F6F3C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwDeleteValueKey [0xBE8F713C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwDeviceIoControlFile [0xBE8F9038] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwDuplicateObject [0xBE8FB210] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwEnumerateKey [0xBE8F7252] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwEnumerateValueKey [0xBE8F72BA] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwFsControlFile [0xBE8F8EEA] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwLoadDriver [0xBE8FA7AC] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwOpenFile [0xBE8F8B84] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwOpenKey [0xBE8F6C5C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwOpenProcess [0xBE8F755C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwOpenSection [0xBE8FAD32] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwOpenThread [0xBE8F74A8] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwQueryKey [0xBE8F7322] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwQueryMultipleValueKey [0xBE8F7026] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwQueryValueKey [0xBE8F6E04] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwQueueApcThread [0xBE8FAA14] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwReplaceKey [0xBE8F677C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwRequestWaitReplyPort [0xBE8F9C00] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwRestoreKey [0xBE8F68DE] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwResumeThread [0xBE8FB0E2] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSaveKey [0xBE8F657A] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSecureConnectPort [0xBE8F9218] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSetContextThread [0xBE8F7856] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSetSecurityObject [0xBE8FA8A6] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSetSystemInformation [0xBE8FAD5C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSetValueKey [0xBE8F6CB2] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSuspendThread [0xBE8FAF6C] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwSystemDebugControl [0xBE8FA6D8] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwTerminateProcess [0xBE8F7628] SSDT \SystemRoot\system32\DRIVERS\klif.sys (Klif Mini-Filter fre_w2K_x86/Kaspersky Lab) ZwWriteVirtualMemory [0xBE8F769A] ---- EOF - GMER 1.0.14 ----